{ "Event": { "published": true, "date": "2025-12-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-01", "timestamp": 1764633782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3dad2b14-4e7f-43fe-a811-0c227eefa614", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c404d4-ce9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583700, "uuid": "5b7d2ad3-30b4-4423-bb22-eb0bc3c11860", "comment": "Malware payload (Mirai)", "value": "af9b991ab8be9aae2caf03d602d72132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583700, "uuid": "88c9657b-a0d0-4a91-bbf4-def6fe4f19c9", "comment": "Malware payload (Mirai)", "value": "0027d9b8b9c5608184bca9daefa5e26ad08a9bcf7f879372bcf4c4f09eb7dc5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583700, "uuid": "96a6edf2-5938-483d-895a-724826910e23", "comment": "Malware payload (Mirai)", "value": "2c51b56add39f2ee797ae4669655f50da98f60d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583700, "uuid": "b4c2a0fb-2ec5-4dd4-8ace-acbb630a6c0f", "comment": "Malware payload (Mirai)", "value": "436fc04ab1d05fac0aaa6f13208bb26e32db366dd21b7b0dc3eb120fd183580e2c47faf81cdc3de7df0e4dff39451652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583700, "uuid": "a492dc6c-bc23-4995-8dcf-4ccf7b095f32", "value": "T1A0C34B0A78D230FDC687D131526E9F21E936749C42183DBBA386BE711D3AEE12E15F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583700, "uuid": "1b71e5f2-637f-4b82-a2d2-13427e99ff84", "value": "3072:Ho+lSV1YjkxBqZax5y1RTgpPSVc1bVDQlO:HtljZ0pPSVAhDcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583700, "uuid": "a9a45981-1163-4c6a-923c-a8203f75042b", "value": 127904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583700, "uuid": "69a0c20c-98ec-45ac-9b5f-5e4968098724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583700, "uuid": "189b05bf-a0b0-49a9-9efe-b16db0b10e44", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806a601e-ceea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764616702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616702, "uuid": "0cf66ee1-c6a5-4aba-a66d-6569fa828c1d", "comment": "Malware payload", "value": "48cacc507827b8916ddc5513b8fc81d4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616702, "uuid": "f3b0bcf1-fb67-4356-9e0a-40087d865757", "comment": "Malware payload", "value": "0142dc7d086ca275b229c427cfcbe3ffe5b8add65f34786914b524b7d36160f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616702, "uuid": "7c4a6446-90df-4b7c-9e76-ca5263557509", "comment": "Malware payload", "value": "86283bb8cc0fa0ac8cfc4c77657ca05b951e0104", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616702, "uuid": "5f5f5d45-fc0b-40b1-8173-d5902f9a1df7", "comment": "Malware payload", "value": "b3d9b850ebc67a03ba989f08b7c4e960face6c5d18dbfbf2421366be765942d35cb9e642d7dd25fe4300a7db23a19830", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616702, "uuid": "9bf9c78d-7f13-419f-9607-9b489bcea179", "value": "T1DC378EC1A2C14061F564B0B1582EE1BE29216F954720A7DFB3E87F1A7971FE26D3A30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616702, "uuid": "948386f0-6272-47db-ab22-715b9a05d5d4", "value": "1a80c6375b1e8b4fb7647584a007db18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616702, "uuid": "1cf5d90a-ad43-413b-a6b3-f2421239f02b", "value": "393216:JkEU0Xh/E2yphhJsv6tWKFdu9C5yi1UZCL+MetSN+HO6/xeZgl:Jkn0Xh/E2y1UZCqMYSCxeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764616702, "uuid": "a6abe491-0213-4a3d-9e7c-13d602fa7da9", "value": 23817216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764616702, "uuid": "a06803ac-80e0-4739-8de2-6fcfee66a273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616702, "uuid": "fa1db4d7-b1b3-4a64-b138-0079e4c97675", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24162fd6-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621701, "uuid": "18e4d996-8a59-47bd-88fb-5fdd2126be1d", "comment": "Malware payload (Gafgyt)", "value": "fe8cb715cb1cd2927bff46ee6c045f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621701, "uuid": "31e99111-380c-4c19-8476-5fab4932242a", "comment": "Malware payload (Gafgyt)", "value": "020864676030c25fa4ca80159cf0138e6cb2ab26711d8936d89cd3903241b067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621701, "uuid": "362ddf9a-d974-498c-8576-c3692d48eaf2", "comment": "Malware payload (Gafgyt)", "value": "55c5ca473e2ed0142cb6ee4c18384da11df31ea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621701, "uuid": "2a9dc868-1d3f-4edc-95ba-0e5ea26c3cdc", "comment": "Malware payload (Gafgyt)", "value": "a6e15482d299533a4303f94c0fb1cfca50a2c04cac3469158f674858edaf2f30606ebd81cdcba3f3b31e2b2bb15a9593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621701, "uuid": "ebd64c12-e56f-4e83-b163-2e720dcd1fc8", "value": "T19EE32A24F8404767C3D323FAA64D879E7F3517E623CB33116A389DB45FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621701, "uuid": "95e9c283-3e67-468a-95e2-8bb2c702ef44", "value": "3072:6hlLp1zWvkO0PXs/DiW1VrdI5hn8eoadVjkmOMDQ4DtsL6Qse:O7J8/Di2RI5hn8eFkmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621701, "uuid": "048e89d2-b1a1-44b2-b84d-a27eaee7867b", "value": 149019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621701, "uuid": "644574af-acef-4fc3-9fe1-de99f57a2a64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621701, "uuid": "57b3d206-354c-4c80-b701-d6947e081bda", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7208da7f-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764621402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621402, "uuid": "d5f4ff48-e205-4ee5-8622-7c9793932cda", "comment": "Malware payload (RustyStealer)", "value": "884866f0185bd2eb297993e32edf8c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621402, "uuid": "cdde7b40-290d-4a63-ab8e-48bc9a4e757b", "comment": "Malware payload (RustyStealer)", "value": "025a5df32b0b830396285ab7cc86bd99072a9046769fe8778e14a6360410603a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621402, "uuid": "ced1bdad-99f4-4481-a030-1276bb1ecede", "comment": "Malware payload (RustyStealer)", "value": "7284b797d022f6faf045480d055ee83728ab5525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621402, "uuid": "ac9179b0-80a8-4d27-bc04-87b15dd7d56a", "comment": "Malware payload (RustyStealer)", "value": "1852dd063ad8828eeb08b8a1d8d712357d7542a41441a1853853c730bb64a18063c7ca340cd73d99ad7db73988b54eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621402, "uuid": "8caa4ab1-16cd-495d-8986-6e1d5fccad40", "value": "T15207C002FAC280F9C85B01B0696FF33ED7396D244738C6A3DBE43E59ADB1790596A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621402, "uuid": "571ad3da-47f2-4f80-8cd2-c5e4d987bb45", "value": "94dddffc8dd646b8d371573e31e5b01b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621402, "uuid": "bab9fee2-1eba-44f3-9fbb-48873ca22488", "value": "393216:VOJqmaVDc0G0/bIT3fTQW6OKEIrqNp/8zCEJUGwLa3c:VOJqmAcegvMOKEazrJUGwLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621402, "uuid": "3cde39ea-f459-46a7-ae3b-7c259459c105", "value": 17763208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621402, "uuid": "803b97d4-31f1-41e2-a8e6-bcbe7871d3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621402, "uuid": "b037aa40-61da-41f6-85a5-321de03cb600", "value": "rhsremotesupportv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362b9b5e-ce6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563319, "uuid": "3d5c7099-33b6-465d-881b-04503e57ec3e", "comment": "Malware payload (Mirai)", "value": "0c7fbc5b78f78cebe6d323d31874814c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563319, "uuid": "65d38815-4818-416e-b575-036b768952a6", "comment": "Malware payload (Mirai)", "value": "025ddefd5ac0a808cf35eb3b0364d5a1d2140648bce7e633af2ef3e2856f56e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563319, "uuid": "eb8ca98f-c9eb-4573-8fbd-614307b8f839", "comment": "Malware payload (Mirai)", "value": "a25a8813393da83ffd6fbf511e090996c2cf20e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563319, "uuid": "482ec1f9-aee5-474c-b7e5-98344f5936b7", "comment": "Malware payload (Mirai)", "value": "c89a03a136080e33905ecb93bcc8e38dcf5a8c4bfde47404ad009bc987d4950204c1060dd1688b5176554bce5f72a18e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563319, "uuid": "d559f6a8-3d23-4d05-90ba-4c81a46a479d", "value": "T15314C81AAF610FBBD8AFDE3706E9070575CC950722A83B353674D528F54E50B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563319, "uuid": "97ee9962-a72a-4f9b-bb1a-9295ed52df42", "value": "1536:rpL6QiAwpk7TYdaTNK4sozzKD20wU9ghlqYT49Bf5zZHzBGHdZxZ84Chj8SBC3/W:rV6QqpCYokXUfc9FV0lohj/CPc1XOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563319, "uuid": "3fade55f-ba7d-41aa-bebb-66a81f3d3936", "value": 191556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563319, "uuid": "f1178d4d-ccee-4225-9a39-c405e7559fcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563319, "uuid": "c9b92501-b7be-40b1-aee8-e69c30cab298", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7880f37b-cea4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586624, "uuid": "debd99ea-44c0-40dd-8f2b-efe5dca4cb9b", "comment": "Malware payload (Mirai)", "value": "ea86ea8936eb4e3a7bdc2f73db9406c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586624, "uuid": "d4feae05-06e2-4692-864a-d29db0f6c9e3", "comment": "Malware payload (Mirai)", "value": "02c81968271113a1bc6540977d87ee29615b6dc72cdec2cbcb20ae1dbf1306b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586624, "uuid": "2fc6d001-8fd0-446d-8108-cb0143a3cb79", "comment": "Malware payload (Mirai)", "value": "09845ec518a07899d3cbd14d0b4f66a3047adb28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586624, "uuid": "3bad597e-069b-441a-92fc-0c5922d4e0be", "comment": "Malware payload (Mirai)", "value": "80fe54e23d52335a5be947a91f4de35cfb48ea012e88c50f7406e0a8f296eb8537c6bc351aa37615cb7b3a08d114a61f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586624, "uuid": "59257eec-caa9-4a56-93d3-32390293508a", "value": "T1B433F240A582C4228E744874EA6A96479217C7F4B1CF63337538ED249ACF7ED036EB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586624, "uuid": "8ef6f06f-ee54-4103-ad35-f8bb8f47dd53", "value": "1536:mO26s+W5T7wk7hdlwGjGWGxrLYAIVvcjYRBLC:/+5T7wk7ziGj8rLYjvcjYjLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586624, "uuid": "e831b8f7-7397-43e8-b7b3-eec58b52968d", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586624, "uuid": "d66aaedd-b3e1-403b-bf22-dfedf9a762c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586624, "uuid": "1292463c-1313-463f-9fae-f9b882e4fd46", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b42095-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload (LockBit)", "timestamp": 1764590840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590840, "uuid": "aeb7d017-1fa0-43e0-a603-66a83787c3a4", "comment": "Malware payload (LockBit)", "value": "fa7f8ac19be9ec53345019fc7d779b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590840, "uuid": "56b4063b-dc6a-4dbf-899e-36e03800be12", "comment": "Malware payload (LockBit)", "value": "032690f113289d50b672fb3e95b64c801454e8e07fe3cdcb072efeaabcc7a374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590840, "uuid": "b3338bd9-d362-4c09-9012-4c6002e8de90", "comment": "Malware payload (LockBit)", "value": "86f870638ba4a9647e36bab60ee0c11c8de1b4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590840, "uuid": "9304d623-10e8-482f-94c2-04f8caf0790b", "comment": "Malware payload (LockBit)", "value": "89b59a5a9de895afbd9cc81486fb6f050dff529c7e97d109f4ce0b521298dd5e08c686691ec4fec35d3016ae8b9e8847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590840, "uuid": "958326e2-c6f2-4ce5-b0fc-0fec8595a9e6", "value": "T15A25E109E7E809F8E0B7E538C9574902F77A7C4A03719A9F13A4526B1F677A0DE3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590840, "uuid": "edc6c966-7a66-4f41-81ef-83d1c9b4f567", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590840, "uuid": "43714902-d866-4204-b3e0-7c39d8d8795d", "value": "24576:xuDXTIGaPhEYzUzA0/0KZJiPeuhFRIZ/tk1SXjzKDT:kDjlabwz9GPeL81gqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590840, "uuid": "e592016f-015e-47e5-8827-abbe340e5890", "value": 994457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590840, "uuid": "90a55a10-c511-4649-a881-90f26ca88f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590840, "uuid": "559141f2-6f48-430c-aef7-9483655d92df", "value": "bl3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f538b6-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621320, "uuid": "8499d988-1193-4ed0-9f27-8bbc4f911b57", "comment": "Malware payload", "value": "8ef405d7a3b5723e242b443229a58cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621320, "uuid": "f3ce61d4-6ed4-49dd-8b79-908de60d99a2", "comment": "Malware payload", "value": "049bef0f241dd0b63453e7f8e547560ce8f2d0b3c72c18dcf2813b29d0dbe802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621320, "uuid": "8c0c39c3-677f-4205-ac56-5318f945715d", "comment": "Malware payload", "value": "96e79d3e3412f8dcac06b91dba9a99dca83b0651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621320, "uuid": "d543cea3-af50-4511-9cd2-a9ba56f1f81c", "comment": "Malware payload", "value": "de11a778fc8e7530b656703f815f35181e0ee9a31c85979bc51f8ddd087a7f3c3e68807135b2be92aaa6f0d7c26fd5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621320, "uuid": "f22a0cbe-1b61-44c3-b327-38632c56c521", "value": "T173373339D4ABFBA9C423EA35F382FFD34D29251A28565CFDF21F350670841BA9439419", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621320, "uuid": "a328b447-d211-47d5-a7a6-0ada4a3a07e5", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621320, "uuid": "f62b3c02-2103-44f6-893f-2e8fefea9666", "value": "393216:g5SK/2E53TUdvPRPm31+XMsSAKW0RwNTqUCmLwd0Ieitb6xt6AseSaPpCw4gKnK:g5SKOEJI7VOkkYeUCmLaeitstRCw4gKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621320, "uuid": "a6453a22-4821-4728-907f-0c0585312334", "value": 23665705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621320, "uuid": "6b31cdf3-4ebb-441a-8232-d92325d1dd46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621320, "uuid": "d0e4e5c3-6bc5-40cf-bfb1-c27027bf06de", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0091912-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608702, "uuid": "bd5d975b-7736-4038-a091-161fe8f18fcb", "comment": "Malware payload (Mirai)", "value": "b83a353a07f82c8225736aeacd6572cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608702, "uuid": "cc129fa0-42a4-4e51-9a10-e62fbca3d5bb", "comment": "Malware payload (Mirai)", "value": "04ffe48e0d7b5fbdab26c29cb6a3f85aa60fd3f3fb78573f17ef49e25409e2af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608702, "uuid": "96801ed3-5504-44f2-a1a4-564f4ac6d6a9", "comment": "Malware payload (Mirai)", "value": "aa8b5689f81d0b956c4f8629be5b5908eb2d9f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608702, "uuid": "9c35f3f0-301d-42f8-83b4-de1ab2563771", "comment": "Malware payload (Mirai)", "value": "c616428421c520fd24e6d8e9c01d6241f453d12b538cfc181806435a6f9d2fc9070ae6e8aaead1403e4ce9266d92021d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608702, "uuid": "a9754555-9200-411e-896c-8997f985e6b0", "value": "T1BEC37BA86A0F3D92D2C7D37DCE484E62712B79F1C62193F07D02536DC69BCAA89F0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608702, "uuid": "997df2cd-b37d-4c7d-9de3-e38f3d161630", "value": "1536:aIuZJtBGgUgmbXebNu0DhR4U/SmC7DUGhIio8UwGMfHFKVbEz1KdlRH3xgtONx49:XuZDUeZhDhR4hFKVbEBK1IOnBqWeNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608702, "uuid": "586af419-2c6c-4e2f-905d-08dd96fae656", "value": 120616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608702, "uuid": "2f7122df-0421-4194-89bb-70ae917e3174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608702, "uuid": "e8e10c1b-1b2b-4bfa-881c-659b170407a6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadf05b8-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621148, "uuid": "479df39b-4713-4ddd-8e6b-6ebc1ca9e898", "comment": "Malware payload", "value": "1ec0f7a930ac0c3a8f983bca474042e0", "object_relation": "md5", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621148, "uuid": "9b691b1c-10be-4fd5-b345-3f3d38ab306a", "comment": "Malware payload", "value": "054308a34e0ac70a6c6f9aac99cc4e6e61cd884a03a491854a698d0d90a06f84", "object_relation": "sha256", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621148, "uuid": "9b3f2faa-a66d-49fd-9b35-ec047457105e", "comment": "Malware payload", "value": "d140f73b4be36fe9a5007de443efb20821243115", "object_relation": "sha1", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621148, "uuid": "601cd06c-a1f7-427b-8c46-a0fa8efe4256", "comment": "Malware payload", "value": "f9f0916642e4c871103e7f230fb5987f83851e1363d9999d9c8200cdd6c3ee356bad267640b1a79316e9bb27ffd43aa0", "object_relation": "sha3-384", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621148, "uuid": "f1616f19-2227-4bd9-985c-16987faaab9d", "value": "T140B52342AAD984B3DE3013F018FE428707367C758AB8972B3785684A2DB36C57936777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621148, "uuid": "d0e8e962-3979-4a70-9a8c-f497961040bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621148, "uuid": "0dcf5313-5c24-4e6d-81c4-18e06bfe2ca7", "value": "24576:Vy5bm/WXaS5S7O/v94aiFJK8bdW/KrYSCinNtS+j2F+:wtm+v5NX8FJeeYSlNtfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621148, "uuid": "3de5df10-bb70-487e-a742-7643d68af843", "value": 2292224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621148, "uuid": "9901b078-55fa-484d-9892-fa8516d3d17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621148, "uuid": "618492a6-cd6a-4098-b486-b53734ac2aaf", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95fbdd3-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608744, "uuid": "3852e289-3370-435d-975a-00039ad75daa", "comment": "Malware payload (Mirai)", "value": "c723a2f4e265509a80209de8d8c4900f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608744, "uuid": "f8c2c9d7-6c18-45e3-ade5-c54101a459c7", "comment": "Malware payload (Mirai)", "value": "059405311cddb9da56e9bd14b94ee742095bbd3babe532fe9b76cab761c50e84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608744, "uuid": "ffee7db2-27ba-440e-b867-f9bc19858f69", "comment": "Malware payload (Mirai)", "value": "15b2b2826a0bb0a4c8d6f386abe668c369e60c0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608744, "uuid": "73ffde69-32d4-4c08-a0ec-6e2a0058d5cd", "comment": "Malware payload (Mirai)", "value": "454f1d2870ccbe5c00903851f15a1b87faa29a0fd89896d1cd49fbec527412582cf75610e4195add8061769cb2cd3fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608744, "uuid": "c8a5946c-4094-4a22-8152-11f5396732c9", "value": "T14E333B41B31C0543C5B36EB03A3B2BD0E3ABAAD122A4E385751FE68DD0B5D369546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608744, "uuid": "8f959ab2-1665-4251-8b57-1a36582727c1", "value": "768:pKelPHJI7SAoWXOGwRCy9L/TYAGjpWvDfnmux+FF8tVGizoIw:YsPpDW+qsLbYjw7fm+y8/1zoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608744, "uuid": "8a96d3cd-1b71-4240-bbb3-5817a122ce32", "value": 50652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608744, "uuid": "ed5ebdce-79f0-4f8a-b8a8-91777c42b04f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608744, "uuid": "8c1072ca-b97e-4338-b993-397438f8d53f", "value": "niggah.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ca75d1-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764591021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591021, "uuid": "838604f9-7f80-4f48-ab94-43b7a3468701", "comment": "Malware payload (NetSupport)", "value": "9f8a52cc7ad3a4a37d588be59255a250", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591021, "uuid": "943693d1-67a6-4427-bc2d-295deb074179", "comment": "Malware payload (NetSupport)", "value": "0672a1f986bf8c8cfe5e33632de86c77e4742f70ae900d1973b6bc3cb436a6dc", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591021, "uuid": "2952b31d-609e-4781-8587-f8c2a41b542a", "comment": "Malware payload (NetSupport)", "value": "c355dd7656ba489d2c96c8f90ab0b1928b5fe689", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591021, "uuid": "3623287d-1103-4c88-a952-5968c3612f78", "comment": "Malware payload (NetSupport)", "value": "47e80bea9f37c763c09dc54ad35775c7da5ac011d349f94a8c32adecd6a7166889110d95b896f92f98e8080f3ee3adb0", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591021, "uuid": "5b0119ac-c9af-4f9c-8f1b-8f032ce27879", "value": "T10D768DB284577C37BD6D384B50042FA29E69164B67188E46FB303779B2EC951DE3C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591021, "uuid": "1d0c2b17-607f-49e0-a3bc-b76282c3d85a", "value": "49152:TdPmX3AXU+yY/F4+9J5Py/nXOtAT9qN5izc829/EvUw2Z2ORDHHIS8H4l/Tw/b6M:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764591021, "uuid": "85b18ab5-df5e-4695-bb88-9fd53c5cfb7b", "value": 7272725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764591021, "uuid": "bfc725ab-473f-4357-b81c-c956f068d445", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591021, "uuid": "8b07297b-e76b-4b42-9567-ae3d7d2785d6", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215ddfae-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621696, "uuid": "310e066f-0409-47b8-814d-b4cdd191a73b", "comment": "Malware payload (Gafgyt)", "value": "e6b6fd0ea2ce40badff1eb4e44d6db11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621696, "uuid": "ae7ea11c-dca8-454e-b0b2-d151d9575594", "comment": "Malware payload (Gafgyt)", "value": "07d061960ee63fcc7f6e5aa51227aa5f99d63255648719e8fdd5eea10d1b5a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621696, "uuid": "9c99cfc4-0ad0-4c64-8a0f-b334cef3d85e", "comment": "Malware payload (Gafgyt)", "value": "c5a5a1a8b55152bd1f6721c57192fb6aff1c8e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621696, "uuid": "f30309b8-4c0d-4b40-b9f1-06c121e29022", "comment": "Malware payload (Gafgyt)", "value": "52e9625a81a53e049129853cfb2012b4c60b4491d40c9168617b468a3614624d3125d82abe2efed5ce834ad20ec095b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621696, "uuid": "7f5e3d3c-0033-48b6-8a33-9396df6ebb6d", "value": "T1F7F3B63BBB160F23C0C500B111E76632ADB5C7D634F952D76AE06DAC6F2A5883465EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621696, "uuid": "53e5b80a-2455-4127-a979-667825b8cd27", "value": "3072:Mqnuwd00SXON8CmphapM7I5n3lNsmzjEq/dNYy2Se:MqD+/phae7Ix3XsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621696, "uuid": "fc6074d7-11eb-4f34-9506-5363cef42b48", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621696, "uuid": "f23bffdc-c088-400f-81bb-495afa29525e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621696, "uuid": "bd948aca-e7e5-40b7-830f-a72252b07f9c", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa20ec2-cebe-11f0-a129-42010a9c0007", "comment": "Malware payload (KongTuke)", "timestamp": 1764598009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598009, "uuid": "917dad04-d58e-41cd-9ef2-addba94ef873", "comment": "Malware payload (KongTuke)", "value": "434d44601649cfcf3fd66633bd1ffa9a", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598009, "uuid": "712d36c5-77e1-452c-8066-359eaf59ab1e", "comment": "Malware payload (KongTuke)", "value": "087507d5ee5cff21462617799ca22f44abbe533f372e211bd89e1aed5bcb2420", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598009, "uuid": "100cb478-cb6f-44a0-872f-8249478c48fa", "comment": "Malware payload (KongTuke)", "value": "a824d39385b483a06f1e5f16b0762634ac94119d", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598009, "uuid": "37956811-a276-45e6-a18c-ea2baebba562", "comment": "Malware payload (KongTuke)", "value": "c3f3e7764f826ed5bf6b9c719497aae385b38e8753009ab0bcec9e55909a70b89884937adb6b46f4f14e07e5056ad18f", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598009, "uuid": "ee8aa590-8a82-45de-97de-b29e039990ea", "value": "T185B1B7D7F3E8DA5F646500E8952A311B64E1C2BB4CAF834455C2250FA62F950BF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598009, "uuid": "ff190c0f-3bf2-49ed-8298-5b14d9030aeb", "value": "96:0eagnW6yuE2jfR/uU/mS9fDvG1gKkdrh1gxiBmKFIx90URs:05gW6yuE2jZrmOvG1gFdrh1gxiBmKFIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598009, "uuid": "d5d02c6c-ffca-4fd9-b942-2a654071d2bf", "value": 5217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598009, "uuid": "357ecd27-f71c-47a9-97fc-346457671ac7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598009, "uuid": "e727dc3b-a664-4f3c-b52a-ba4602c9c37c", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79ec1c8-ceb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764594944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594944, "uuid": "c6a0bd7e-6cba-4517-b2f7-67bd12fa2125", "comment": "Malware payload (Mirai)", "value": "33ad0cfe99233fcfae1bb1733114b8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594944, "uuid": "a5a40015-de75-4a5b-8fe1-0d98614f0ec5", "comment": "Malware payload (Mirai)", "value": "08785260bb5198f35562dd6630a61a541ec4f14c02fdf381b1eb9eeaac9436ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594944, "uuid": "81422852-fc6e-4e6b-b270-71d848ef8542", "comment": "Malware payload (Mirai)", "value": "02f06f4f814cb8e2a4cd75bafdee57ce64bf86ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594944, "uuid": "fe11c10f-257c-4dba-900f-ea8fa2216454", "comment": "Malware payload (Mirai)", "value": "1a41dc23369f0282054d51303c9f1e6401ad82c501737596d068d7c2887674d968ee0a417b9b1cae7586cc8ab158fb5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594944, "uuid": "cb5b7752-40b6-4f72-b560-555f1fe3633e", "value": "T149830759BC819B11D5D522BEFE4F128A33131B6CE3EE7212DD245F2427CAA1B0F7A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594944, "uuid": "03a1db45-5439-407d-a418-0997c4772d05", "value": "1536:fVnG+MZymzQnjtBgF1SCyyclyF9VoSJLF6VkgmCNv4Dfalx1ix2MVYexZWmYh0:BoymEjtum3yF9VoKJ6VkgmCNvr7MVYeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594944, "uuid": "7c75af08-17d8-4f58-8a52-46edba8d1614", "value": 87488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594944, "uuid": "27093353-48a8-43d4-893a-3c3fe5dfd703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594944, "uuid": "e0601863-e596-4bce-8af1-242003556bb9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a85a67-cf01-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764626701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626701, "uuid": "87c03994-3594-42e0-a193-b03750c926e6", "comment": "Malware payload (Mirai)", "value": "4dfdd850e75552c415bc451c4376753a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626701, "uuid": "8819618b-0dd6-4568-aa05-976f1526ea66", "comment": "Malware payload (Mirai)", "value": "08c1b60016eaf04ebd42ae7d6a595257259a0078f346c736b7580d1d7277794d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626701, "uuid": "52520e41-86d1-454c-ab59-2e530e07e30f", "comment": "Malware payload (Mirai)", "value": "2d75bb144e946834a6a710c07ba25ad34c5e8ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626701, "uuid": "b38c1395-e6a9-4808-a675-4c3013cb2f47", "comment": "Malware payload (Mirai)", "value": "b89b0955d32f67732ec003c55d08a0ae4f1452a0b2a2aad32ca09483e8a8a5b97361b915226800cb5caeefd8a7044dd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626701, "uuid": "f33e1163-f1fd-43eb-9bbc-267135bf07ce", "value": "T19FA339C7B401DE7CF81FDABB4563490AB531E3515A831E27736BBDA3AC360E44826E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626701, "uuid": "4cc94fd3-804a-470e-bc91-db9a028ba41e", "value": "3072:FhAD3TbYCHC+RmRba1WKslnKT6d58F9OgDSa2:FCzTb1HrYpKYn+6T8lDSa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764626701, "uuid": "02fdee5e-ab2f-4434-ae56-fba2aeee8d65", "value": 105016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764626701, "uuid": "5fc355c2-749c-404e-82de-8f09376c97e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626701, "uuid": "2d89e710-6f17-4d24-8380-dfd59de9ceea", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a37411-ce8a-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764575261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575261, "uuid": "9b0ee49d-55b2-49d6-80ea-7fb3eb437abf", "comment": "Malware payload (njrat)", "value": "77562ccd8291bb5907360ff22f779937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575261, "uuid": "89c26004-087b-4449-b2fa-23d9fe87c126", "comment": "Malware payload (njrat)", "value": "08edc97f63cc5d7ac7ce2fa46811098fd03404bca7a7030d7e17cfc00038052a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575261, "uuid": "a3103208-3a2b-475b-a4ab-6da85d2c5853", "comment": "Malware payload (njrat)", "value": "505e9947d0866583e86a6d023946a8c4b333b046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575261, "uuid": "0f45f710-f45e-4f5e-a0f2-3bbe593546e5", "comment": "Malware payload (njrat)", "value": "6882b1298fe590aba505934b43515cd29c1fc072518ef446aa2fe6b4eef54ac69f162b360346e992723a629997b68992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575261, "uuid": "db265fe1-c55e-488a-8ccb-897aae0151fd", "value": "T1F5D4E7476E928F45E6A02F7143DF6D18038694B29BB26B1F2F20337B9C011E7ED99794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575261, "uuid": "f67e7709-377c-49e3-b82b-eceacf45118c", "value": "12288:u4nEhIMqhEpnybI1Y3CMThrqIiIp7Uz+Ga6UDp:u4nEhIMqipnhM1GIiIy1aDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764575261, "uuid": "7464407a-6ae0-4ccd-8e83-96bc14a55124", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764575261, "uuid": "2e7c5ee2-6b49-44f3-b3be-211ec16e37fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575261, "uuid": "24de9134-2caa-49e8-94b9-953de78e137b", "value": "E790L3445679767765656567655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97386233-ce94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764579803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579803, "uuid": "5c1e6cdc-3ac9-4283-b771-fc091dbf811c", "comment": "Malware payload (Mirai)", "value": "0f3a63b30572b41583b943270166fdf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579803, "uuid": "8703e7ca-1cdd-4876-879a-b4abefdc1a34", "comment": "Malware payload (Mirai)", "value": "09de0d5450fb1ab0bb3b6d33b4c93127e066373a6ea71b26b4fdee4cca1ae870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579803, "uuid": "36ca4dc7-439d-4e09-8e86-4e7bc29d218f", "comment": "Malware payload (Mirai)", "value": "237403d74bbd209ea0b85a5791d86d4a115f61d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579803, "uuid": "8bb17ead-e056-42ef-8ec0-b2a77100376d", "comment": "Malware payload (Mirai)", "value": "8e6769a7a6ebe8d6e5ea97c1b7ea065142029abe1e82dec993414735a1484acbea21bab192d1151ee505f145a6110630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579803, "uuid": "0234ab78-17f4-47b1-bef2-58cdac83eabe", "value": "T1D6B35BD9F643D0FAE81605302176FB376D72E9BE2228D983D3B89E327C12A41D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579803, "uuid": "296bb24c-9f7f-401d-b133-cf1b211c881a", "value": "1536:O1z5kayPMrO/5e2xKKO1lVbIO2FDy7w5qR6U0NhbsnxA3S6qR4nS:KkMrG5e2xKKk/r7Aq0Uots2qRCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764579803, "uuid": "bee7ec49-d53d-40ce-8abb-8e7363671f2c", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764579803, "uuid": "8b7f4ca6-ec4b-465d-8f4e-e433a0a185a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579803, "uuid": "631f5c07-caa1-4d77-8086-163004f736f3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6da16b8-ce4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764549335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549335, "uuid": "a972ee57-8e4e-449a-9f28-cb8a68c503f5", "comment": "Malware payload (Mirai)", "value": "01703c830bf23de549053a39f005d197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549335, "uuid": "13e287d6-bc58-4c1c-9f61-ae1f3987265f", "comment": "Malware payload (Mirai)", "value": "0d264a2c7fb588b3db2caa44a0acb13ac694ff7fc8b389382ae914087db37ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549335, "uuid": "d59536b5-282d-4741-b066-fff66425eb6b", "comment": "Malware payload (Mirai)", "value": "3d94035a847c64747c90519f544be05c282dfe22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549335, "uuid": "d62778e3-0a78-4e89-b27f-8cd8095515ef", "comment": "Malware payload (Mirai)", "value": "00b83b978e3e350df8f9ebdc2affba3eb66b7a84a4942c59bb1cbd521d17bd3ef07f1926d643ded37966d0a811338fd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549335, "uuid": "0a68c69b-ef57-4e93-97c8-96c2b6394dc0", "value": "T176935C42B62C0A47E4A35EB4263F17D193BFD94020F4BA88695FDF1A8635E321086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549335, "uuid": "0820861a-630e-4791-8e05-ac5871de3d81", "value": "1536:iRydMB1xh0yDSND2OYYsSfW9ct+xgFTf57pyR7:VdfyO8SOgWgFTfO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764549335, "uuid": "fa01abb5-0812-419f-bf78-c7cfae15b62b", "value": 93556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764549335, "uuid": "4ae787c5-a406-4ad8-b13c-a5f5ba3b80cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549335, "uuid": "a385d05e-2b16-48ea-a045-d9e6f4e3fccd", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354fff0f-ce77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764567183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567183, "uuid": "452c1d0e-7b72-4f22-a0cf-4477521aa402", "comment": "Malware payload (Mirai)", "value": "907328dc68e2a9e7dedc13a4a33fef08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567183, "uuid": "8c857ea8-7344-460a-9238-e0b2fb5a93ca", "comment": "Malware payload (Mirai)", "value": "0e7ff0d9b6a39fc2196676905c970f18c7c48b88f39c7568d230b07c28b70f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567183, "uuid": "cb7d16f9-3586-46e8-9c24-bda865dc1473", "comment": "Malware payload (Mirai)", "value": "1b17f38f3244dd5e350791089f90db929357c020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567183, "uuid": "3f147e46-f851-45ec-bcf5-58fafe6e76f4", "comment": "Malware payload (Mirai)", "value": "e5775afec754ec148b66c816521bda261c0ebc72e204272b7d4c0518f27759749242f19e1e0f0e9b1b54fa9bc2695fba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567183, "uuid": "1da35987-f1b4-4cf1-85e6-f2f4c066dc7c", "value": "T17513F03898005167EB7B3D611D01F786FB970E6BE3BAAF520BD09B0105325AEE308CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567183, "uuid": "5bca7303-e990-4915-b205-1260d0ea9afc", "value": "768:QnlKSSUz9T3bwVVb6f88K8UC/BldwIT9Mv3luOkPcY+o4uVcqgw09/:QnXZ8/CoC/fmi4u+qgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567183, "uuid": "a7950189-7f2b-44f5-aacf-4a28e4a91d68", "value": 45508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567183, "uuid": "2490bc1b-f13a-4daa-bbbc-c124228e76df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567183, "uuid": "f4e4e0f7-a025-4520-80bb-f82bf3bee247", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a343f0-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547472, "uuid": "a7cab02c-75d8-437a-af3e-7c0c83410f94", "comment": "Malware payload (Mirai)", "value": "1c30aa274ca6c20978fdb7825b14b23e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547472, "uuid": "9192bcb4-50d7-48fb-adc0-f73809f762d6", "comment": "Malware payload (Mirai)", "value": "0f36fb6b5a0d97d59811bfd9b036bafa8947b198a315b9206827df53412eb1d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547472, "uuid": "dc9f48c7-a664-4c27-8d3c-2d658cec2f40", "comment": "Malware payload (Mirai)", "value": "3a4632308d5b0dc8495fe56dd2c9b3b5c911c3df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547472, "uuid": "574dbfae-9f5f-42fd-b16f-e5a917420213", "comment": "Malware payload (Mirai)", "value": "2bb8d1c3082902aee470aed8d2c3492d28fe32006e56360fc586b59413fc873ceb57f4ed79be53be8178e7d83d3c60ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547472, "uuid": "3a2652b5-4f91-41f3-a8cc-ed71ebfce6c6", "value": "T15313F138D198159BEF6E7E561E08D3C373810F6BE66BFD930BE16B80052227927059C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547472, "uuid": "3103af19-a342-412e-9ae8-b4664c5373ea", "value": "768:inlKSSUz9tykoz5KirmU2BhjLdXLqOEziPgkaysD4uVcqgw098:inXTXohrm1njZXL3EziPgku4u+qgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547472, "uuid": "f969a05a-e397-4eb6-ad13-cdb5c72fceb2", "value": 45524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547472, "uuid": "b41f34bc-7c02-472c-b496-0abb934c72df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547472, "uuid": "789718f7-fde6-4678-a7b2-209e488988a9", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0885dd-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608749, "uuid": "a4e29733-1dd4-4494-959a-56d07191fb55", "comment": "Malware payload (Mirai)", "value": "8bfd3e7003174ed6d9c7b27e41236e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608749, "uuid": "e351d1d5-b8b0-45a6-b607-e2e9fec36b0d", "comment": "Malware payload (Mirai)", "value": "1191478a3a7a9f16585b40155e4a915834d370a58d73e83277c12d005bc99d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608749, "uuid": "f0083497-7462-4c34-b0b0-d8e83b476819", "comment": "Malware payload (Mirai)", "value": "4cf04f86cda9e6f3cf990171a33cbc08d3bb64c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608749, "uuid": "904f2e48-8558-42c7-a7ec-d7a576d9b0a1", "comment": "Malware payload (Mirai)", "value": "68a147f84cee93b46b22145568f807fb42053476fe48e23a31961f04b6dadb3ad6362fc156369293b64914546005806e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608749, "uuid": "e4a6700b-4b09-46ee-8f2e-8de7b0e73ffc", "value": "T19E63B609EB554EFBEC6FDD3706A90B0534CC551B12A93B3A3574C828F65E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608749, "uuid": "05c841ed-3dad-46d7-9846-9a9b8ee8ba8e", "value": "1536:+L0EeKrdS4wV/4LmVbnZEinyLtaFl0zqv:+L0E9wwLKnXL0zqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608749, "uuid": "523c8205-4170-4e48-9822-ccdbf481c5fa", "value": 72612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608749, "uuid": "88c97365-fbfa-4267-8ea6-ab91ec519b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608749, "uuid": "38eb7fde-30e0-4803-809a-2d90f41f2526", "value": "niggah.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00468c21-ced8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608756, "uuid": "de4ca501-1f68-4d7b-955a-4a1f5da0aabc", "comment": "Malware payload (Mirai)", "value": "b85e5df45c03504ae860da1b91a2154d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608756, "uuid": "bba09daa-29a1-4b80-9a6e-e64c5a308f22", "comment": "Malware payload (Mirai)", "value": "129a44e373bdb0e07469fdc93aae552c2600734a66c86eb52d445ed011d6f7bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608756, "uuid": "fac5df49-c4fd-4504-b2b9-fdc5c2ff5cd8", "comment": "Malware payload (Mirai)", "value": "3ebb1015e0a9c640ac923e448442c177f73780a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608756, "uuid": "e4d7e390-7471-4902-b6d3-bb738ef8b41e", "comment": "Malware payload (Mirai)", "value": "2acdd2a163766efeb391754dd4a8082549a75b2d7d9b24e61762ac3d1e3f2196154274009c0ac76f59e0ee6499b62945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608756, "uuid": "d0851a19-3ee2-4337-baa6-b64c18bf45d8", "value": "T1EE331984B891AA13CAC116B7FF4E43CD7B161398E2DE7303DD2AAF11378B92B0967545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608756, "uuid": "73679abc-3030-4a66-bc21-5503fd4c8412", "value": "768:yphFYObA3wnVB+YVE9iEMMfvo6eYxM12SU2C5oDmBL/VVC094wWBivlz0I:OFYZEDV/xyvhY12vf4mR9wbBivlz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608756, "uuid": "f3ae4bd1-535f-42bd-8bb4-7e51a3e6e9c8", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608756, "uuid": "f4dcd087-ef57-4129-aef5-c98c1e7bcbb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608756, "uuid": "bd2f91c3-1cd4-48dc-a680-288a53b1f6b3", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5959bfb-cee4-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764614214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614214, "uuid": "fb01ebc5-b10b-4d98-8ae7-f68eac318890", "comment": "Malware payload (CoinMiner)", "value": "0c153d2ef4cb0565df75b0dc649dcbfb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "Win64.Infostealer.Heuristic", "colour": "#15445C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614214, "uuid": "b8561a21-485c-4084-89b0-019f864b41c2", "comment": "Malware payload (CoinMiner)", "value": "1316ee07c19db2d29db1b47966b90e56c5dbd9345f56f9443d9e6ce7d51838a5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "Win64.Infostealer.Heuristic", "colour": "#15445C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614214, "uuid": "c03fcf7f-952f-453d-97f8-a7e658c1416a", "comment": "Malware payload (CoinMiner)", "value": "718d2f8c625d248ee8aee5682f7a1dcda4c1fc86", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "Win64.Infostealer.Heuristic", "colour": "#15445C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614214, "uuid": "a1ec30bd-b290-448d-be91-100d6a0dfe30", "comment": "Malware payload (CoinMiner)", "value": "53a07bbfe7a49b9238318aeee0687768d756fc0dedcb867cc68d1a873b6e080c2c6a478ef88bd8d562a5a20d8c354411", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Family.XMRIG", "colour": "#C9296E", "exportable": true, "hide_tag": false }, { "name": "Win64.Infostealer.Heuristic", "colour": "#15445C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614214, "uuid": "2e261e3b-a7b0-457b-b2c2-69e0e0dea446", "value": "T1CE863388BADB8CF6C02DE37C639213DEB179B7A5942C84E339E9B925CC175446C39790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614214, "uuid": "816bae33-6469-45e6-9182-74a16f407aa8", "value": "bdd6fb009a74dc11b87797d3c9e9689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614214, "uuid": "da5b7dff-276c-4506-b6d7-8a100239b2f2", "value": "196608:RqmjrpGUcn72vBAw4WmBz8gt08eFYx63fBJ+D:RqyrpGUcnEy8mZt0lF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764614214, "uuid": "08bddb10-ea54-4f37-b218-6424500e28ab", "value": 7887408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764614214, "uuid": "ff5c414a-37b8-47c2-8d09-e87f5caa19bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614214, "uuid": "8c52cb00-7378-44e9-acd7-267ca004b1d3", "value": "WmiPrvSE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15da5ae-ced6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764608301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608301, "uuid": "41fb8249-6a50-44dd-a1f4-6c6e4fa00d20", "comment": "Malware payload (AgentTesla)", "value": "b4d09be1eb5caf51890ec3cbc8e0f949", "object_relation": "md5", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608301, "uuid": "4dca5d8d-923e-4d69-8472-74c9a3f832b2", "comment": "Malware payload (AgentTesla)", "value": "13aba9fcbf2494eb657177fbe83279c1313e7791f1086d9d1460cb66b5eff4e5", "object_relation": "sha256", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608301, "uuid": "8a8c5c4c-3961-458d-9935-c97d82ed612f", "comment": "Malware payload (AgentTesla)", "value": "e68839e93cfccd6703250a13fef99dac50d94ccf", "object_relation": "sha1", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608301, "uuid": "c5c8b1d4-dae4-4feb-9892-b3b17fbe5c79", "comment": "Malware payload (AgentTesla)", "value": "c97561b866fa0888e58d355e91e33bd45243673e0adb717b50af7c48451103cc124ea698de8785b69d1af56aa0908059", "object_relation": "sha3-384", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608301, "uuid": "404c16ec-da55-4ea8-9327-b168525a81ec", "value": "T185152302BE94755807F0DB1CA0BD2E2F3F4D5E96800CF2C6BADD849B4728655DE1B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608301, "uuid": "afbe4c80-d0e9-4089-9169-461c688d03d1", "value": "24576:C6eIGZL0XYHmElVj5tciYKKO+jXKXHhHd:heIvXY7XmlOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608301, "uuid": "cadb975c-d5f6-43fa-9378-e0b573a724d9", "value": 907687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608301, "uuid": "0ceb5dbd-177e-4b9f-886f-03a0e61b5578", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608301, "uuid": "15025e1a-8d98-46f8-a078-61c9c8072d65", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6430f4e-cead-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764590646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590646, "uuid": "6e3a9c1d-06e7-42c1-9cb2-8e88b19591e4", "comment": "Malware payload", "value": "055a390d9e700685eeecfaf499593363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590646, "uuid": "e089a39a-440e-4835-9157-f3a89768913d", "comment": "Malware payload", "value": "14319e2725465dcc048e2f634efb5442f07fcb1bcf836df2c98bca74cf4c35de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590646, "uuid": "95ac49dd-87fb-4c54-9d1d-a08ad2c25083", "comment": "Malware payload", "value": "86d97e6d12076d9ec1db544e4340de4daa9d977b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590646, "uuid": "fd327160-c9b6-48b1-89bd-815e76488c2c", "comment": "Malware payload", "value": "1e902ee13c197d650d6ab51582e17acd1cda44029e4d320020595c5cbc8092c9f41ac3cc4aed45abed4e3245d9b44418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590646, "uuid": "eb744f79-56f2-48d9-b49b-a16c7d5905a5", "value": "T1E52833099A9198D8F7FE9237E6804A44B956B4CE4377878B27F814320A8F5D2CDBF135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590646, "uuid": "346a4084-d99b-401b-9ae8-6e7a0d2dcfe4", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590646, "uuid": "4edeb70e-4094-4c95-94da-5489ee6d90e2", "value": "3145728:fgYRPSC++6y9JkBuDX5M3gbcKCWJ2qHO5iVf6RU:fxaC4y9OgDE2CWPHCix4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590646, "uuid": "a4245429-6819-46c4-86f3-7ad86ad3b4e3", "value": 102496343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590646, "uuid": "ba12cd82-0af0-41a3-9815-a6c746780103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590646, "uuid": "2b883f84-98d1-4c81-8e12-27dcdfea8caf", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c612f5-ceac-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764589916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589916, "uuid": "c3ae45d2-8f1d-4572-bad9-13a9c18d6e58", "comment": "Malware payload (Loki)", "value": "b12898afda20f58f68851fe5d446ca30", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589916, "uuid": "39825107-e827-4c4d-8b75-b4daf9578d25", "comment": "Malware payload (Loki)", "value": "1544203c3e0083885b6dd08bf47e9cccc1beeef978832b1a975eeb926482a86e", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589916, "uuid": "9c276269-f633-4342-a5ed-c571c5665774", "comment": "Malware payload (Loki)", "value": "3855b3263f206cff6f5ec77f867973d4dc8faa96", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589916, "uuid": "c1fc9f31-ab15-4349-ae4d-0dc801e27ae0", "comment": "Malware payload (Loki)", "value": "b8c6a3d44b4f27b76f7a5b26e22d7b98efb93a1ce0bf0a55f52d717a48f6ad8ef8d8b735bcae0038530c4154d13d9404", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589916, "uuid": "d4823a2c-953f-4047-8fc0-5cbb1c6f4cb5", "value": "T121F4535273C0786423475B3A772FF0E5EE1B88E87658044BD126BCB0A67D71AEED4932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589916, "uuid": "c52a8bbb-a1d6-4ff6-921a-885a9887c391", "value": "12288:ry1jZtGk1auli2uigtwpNpZHscN+OB46ZR/l4yNcSAQhdKZO0:ry1jZtGkNi21scxSy4yNs8dKZO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589916, "uuid": "9b06b0d5-37d6-4298-b34d-bde3357a0a50", "value": 771986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589916, "uuid": "bdf86019-d132-4e92-b457-d8eb56edba8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589916, "uuid": "f1689a6f-d108-40fc-bcc0-705c3c8603e5", "value": "LK0987654567890000.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a339d51-cee9-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764616208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616208, "uuid": "6aef58d7-250d-43f1-906a-c60bbbba024a", "comment": "Malware payload (njrat)", "value": "0d37ed1d82fa4f0b0c044412fab0d60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616208, "uuid": "0c6f76e7-2b36-47b6-adda-5a448ddeaf26", "comment": "Malware payload (njrat)", "value": "15c53d580c9b05381a8bff9a60f83d82654c53980426998c3b1d0c9145d69f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616208, "uuid": "03b882d1-a608-4aaf-b968-f5510ed3a210", "comment": "Malware payload (njrat)", "value": "8d8f1811103fbd707193ce379a51654b653bde78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616208, "uuid": "0ae1f524-7f84-4dfd-8c52-db5014de7ee1", "comment": "Malware payload (njrat)", "value": "892562e8c09f9430ab63176d826afc64f3d5188528bc6aa7972c4ccf350ef38da0b408a0a9125b70a27cb15711ac4cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616208, "uuid": "d5e9c331-3f21-4a89-ab93-e28ba9e64ebd", "value": "T171E207467BE58219C6BC2AF88CB313210772E3438472EB6F5CDC48DA4BA76D40641EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616208, "uuid": "5e8b5c12-9b35-4ac5-8bc5-5386e20c3fba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616208, "uuid": "6c6101b5-87b4-452b-8219-7968ff105579", "value": "384:g0bUe5XB4e0XfOZeANuiEO0YaHWTgtTUFQqzFuObbm:FT9Bu2IguiEYuAbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764616208, "uuid": "f0db6f11-099b-4c0e-9dfc-6a7b015ea900", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764616208, "uuid": "e2fac349-3ca8-48df-aefd-e8879d6ba211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616208, "uuid": "57952c75-ae23-49fd-b1e6-b396c412db0a", "value": "0D37ED1D82FA4F0B0C044412FAB0D60E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09307d0-ce8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764577242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577242, "uuid": "8efb4fd2-2166-4c55-890b-453463ae7f22", "comment": "Malware payload", "value": "f1cb05338bee1dba514361754481cf45", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577242, "uuid": "8fe42da3-bf44-4cd6-8cb4-e59ec12d966d", "comment": "Malware payload", "value": "173d9afe182cb15129947296b2574b7180d682c2a075e4d429e4b848d7d5bbe3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577242, "uuid": "7a554a36-c6b4-4136-a555-6fafe150d550", "comment": "Malware payload", "value": "72ae22f6ed2fe9e0262290737cfb3d77e8ebbade", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577242, "uuid": "1b926f9d-ce31-47e6-b8d0-af137cb9b332", "comment": "Malware payload", "value": "1955a4ddab4d2e813849d3cfdbd0faf18f02235134236d2f4fb44ee2c99d86838ba086b28297c781a3b5896f2d0bf580", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577242, "uuid": "6210a036-9548-4311-97b0-5fc703721f1f", "value": "T11D460612AB109DB4C29FE138B965D1B162237C58073032D30A6E7EF39D727D5CABA758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577242, "uuid": "6dd31154-a416-49bf-89c6-721a16f7452d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577242, "uuid": "392a3471-7c0b-4574-9814-898b3df0232d", "value": "49152:SFgDUSy67ZBH76dysjEfB6BQpOW6JZxoCRYLRVdkZRYDfDRmNoc6Cg+MyTD1m2k:FVBS9WPn/rDfDRmN/6JJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764577242, "uuid": "3728141b-7d34-43d6-b577-d65916252f27", "value": 5569752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764577242, "uuid": "0be13b7c-95e9-4122-ba5d-4642c5de1068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577242, "uuid": "715a853c-0d67-45ee-a651-475f9358c731", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bdd28e-cec1-11f0-a129-42010a9c0007", "comment": "Malware payload (TrickMo)", "timestamp": 1764599188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599188, "uuid": "18c0ce9a-58e0-4224-9431-5da6d9217b0b", "comment": "Malware payload (TrickMo)", "value": "f98c2f65ed8d3089bb8c1e46e02c736a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599188, "uuid": "cb706eda-3d9c-4fcc-a8df-ea92dc8ee940", "comment": "Malware payload (TrickMo)", "value": "17fc5d1c8bd8b10471131282e42ec289bb1e1ee107ca676f369bb42fc3643af3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599188, "uuid": "d1b7d590-bd9d-47a6-a789-e21da0474e9e", "comment": "Malware payload (TrickMo)", "value": "379833f1c7dd19aad5886c38bea9a84bdb418b18", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599188, "uuid": "714f814d-7753-43d3-9709-09eaa2dccb04", "comment": "Malware payload (TrickMo)", "value": "1ab05879437d2a4a5b360c8bc899d4a39d91186dd4a64243e04c2076fe0e1ffa3b1907d56ebd8d639808f5a6a024af03", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599188, "uuid": "6be24f64-f765-478d-bfbd-75cb69517bed", "value": "T147661243FB08A92AC4E783328975026652069D56C7A3DA47795C777C3FBBAC05E82FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599188, "uuid": "bdb2ac25-8868-4a64-a2aa-382a5e33ce1b", "value": "98304:NAAbmtJ1Iu6zTZfSItA25EEMjwwO3NGug9Nf8DQAspxsHkSyXH:NLbmTi6oArECwwO9GDGvYxS8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599188, "uuid": "b7d855a9-17c7-42be-bdb4-29fd55e1a277", "value": 6865208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599188, "uuid": "299e2987-83ca-492d-b714-23e658a4aabe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599188, "uuid": "36b5d892-5602-444a-98b9-55931438b9b2", "value": "f9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb616fa-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568946, "uuid": "1dc93b27-4747-4319-b031-316d5943103e", "comment": "Malware payload (Mirai)", "value": "57ac301639ebb4116fc2a971a16fb51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568946, "uuid": "1f592759-7569-40ae-9038-ae33609f7563", "comment": "Malware payload (Mirai)", "value": "1820533f9e135473e9b0056efa3de4c781a2535c6e1a4e43c3214ff622b53106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568946, "uuid": "e5863c4f-ce0e-40c6-8697-ed9070405178", "comment": "Malware payload (Mirai)", "value": "a5a68262fea805894397150414d486c371f9f4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568946, "uuid": "2aefc435-bf5f-4846-9b75-cb3d3defdfa1", "comment": "Malware payload (Mirai)", "value": "c1455287c8324432a995b5d95646d1fc17da70f41e5e605e775d0ebddd19b7cc1c0c5312a22d43eca14d09c33669f12f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568946, "uuid": "11082ad2-5303-4224-ae74-96a6d99aa7ee", "value": "T1EDB339C0F98B81F6C40B8C306166F63FDA31D9A95171CAADFF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568946, "uuid": "496c62d2-f2ea-43b5-aefb-f11b64c9323d", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJxlXireDHGKgpuzFlo1OUg:q/ij6i8CsMTMXXyhcQ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568946, "uuid": "8d92606f-0624-47fa-aabf-16c2f303f31a", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568946, "uuid": "cd9f1611-d932-4739-8f13-6a10ff6ca49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568946, "uuid": "62b4c6e0-122f-4777-8994-a918e1b75040", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccd0fbf-ce5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764557157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764557157, "uuid": "c3562107-82a1-4c62-aa5c-faecf8ee8e6e", "comment": "Malware payload", "value": "2565d829abd1cd71e4456514256aecf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764557157, "uuid": "c22dbf20-d750-4c78-a65a-3ca4bb6185ed", "comment": "Malware payload", "value": "1894f49924e697fa176fbad9200bcbd55095d72183a2fc779cae70a6a508f948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764557157, "uuid": "428d322a-ca04-4e32-96fd-13457813a6e8", "comment": "Malware payload", "value": "b16033e4bff6d2fe14caef94cc367139cb3166b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764557157, "uuid": "4a4a2766-66c8-47b4-99a9-ac727acde870", "comment": "Malware payload", "value": "d1ec6e3e1a439134350e05d8567137c7f6578037ce1ce6843157027874d190db5c21d983fcf6463256d24b7b20a1358d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764557157, "uuid": "d1a53f94-5f53-4db9-b85a-17a094e14f1e", "value": "T175B208C5EA39B591D806C035D4E2E7E9E0B470EA53E1A8CF4CC81BE25878FC35219B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764557157, "uuid": "6d1c64c7-38a1-41d6-86f4-f75d42dad29e", "value": "11e4b10e9f0b63925db23a84fc58034c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764557157, "uuid": "2b08d356-8b83-45c1-8a47-30cd8140a5ce", "value": "384:gce4PtNZKaATbd2bvGsOiwxUALVCp5WTGmGDXvKR6/cB+SyuEjxh:A41NZnAd2bvGtn5V0WTdGDXyMpS3EjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764557157, "uuid": "004e15f3-be77-48a9-a40f-31c22d974357", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764557157, "uuid": "b981f80d-3558-43f7-a071-c9ca05c2f9c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764557157, "uuid": "4e42d6f2-97f2-48bc-b3db-8fcaccb089d8", "value": "ve8f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3304620e-ce6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764562885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562885, "uuid": "d685c7e9-73cf-43a6-a9d8-68fbf5247bfd", "comment": "Malware payload (Mirai)", "value": "c6a3c7d80e59f9395f7b534424a91b28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562885, "uuid": "86a81a3a-d3d0-4af1-a470-b13409f830ab", "comment": "Malware payload (Mirai)", "value": "18f8668a863058aa53e3930741f2e3a8c53e895c34fda7cb34b74feabe908dc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562885, "uuid": "ba3b769a-bd76-4aad-b40c-90a708c8e2df", "comment": "Malware payload (Mirai)", "value": "cb3ac657663783707abae564aa19ebb985b2d271", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562885, "uuid": "42d5309e-3270-4867-a546-1520a00285f5", "comment": "Malware payload (Mirai)", "value": "c8f023d5d459025392aa98e54a62eddf659b5c3825b41c1ed4de3bb6a27bbd0bc7815da15b2d6cf9e3b461950f8d8572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562885, "uuid": "4d13c6e6-53ab-4917-9093-417e6fbac1f0", "value": "T114144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562885, "uuid": "7630620f-d92b-490d-97cc-9985e525bf17", "value": "6144:9MygR/fQdiY2xN4aTBMvlZe5cgCHMh493r5M/9pTKF:9MBR/fQA1xN4aTBMvlZe5XaxFu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764562885, "uuid": "44721998-2556-4669-a088-53f6f00723cd", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764562885, "uuid": "ba5999b8-5e82-46eb-b9ef-94309e04d1e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562885, "uuid": "d6718b50-be96-4905-914c-11f19bc4cc3c", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aa6512-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620796, "uuid": "d49bf250-4cc3-4299-9e63-6e325ac8c3bf", "comment": "Malware payload", "value": "858f1d7b195d0ab7559730225426fa9d", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620796, "uuid": "e8745fba-862e-472b-8efd-dc8111508278", "comment": "Malware payload", "value": "192aa31ea7cf2449015d4e26ddff8be8c629cf7d71d3dcdcce9e67919b1121ca", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620796, "uuid": "b290918d-ddf2-4d0f-93ea-f2f882129f0a", "comment": "Malware payload", "value": "ac0f2641923124c14787e4437d7ac8dcad6d7d0d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620796, "uuid": "0781dd83-dea9-4234-87b7-68bc9a82e9b1", "comment": "Malware payload", "value": "44f98614170a11c44789b9afc0f0cc7f3bbe948f8aa2b417f86a958864077024ba86eaebdc941b2e71f5c62b18d765dc", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620796, "uuid": "4e91c17c-f30b-4707-a7d1-c5af5e2ef8e7", "value": "T1B9552312B3EC4136D6BA3F7068F25B432F3278D42978C76B12586A696E726147C73327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620796, "uuid": "da594a5f-ab95-4194-8f02-c06409cd982e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620796, "uuid": "763b896a-5ff3-4e61-97aa-44601da33d64", "value": "24576:gy326EqlQTkjiogwh0VMHU3RgHV4uacT1LvsiTrOTYvkmsi:nG2ViogyTeM4uaqvsNMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620796, "uuid": "deb0e980-20f5-46f7-b5c4-32aa55d36509", "value": 1373600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620796, "uuid": "da7c2a38-a3f0-4623-b69b-f0c284bc245c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620796, "uuid": "f52677cd-4ddf-4a2e-b45a-ae658d1b87ae", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3579f4d-ce7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569569, "uuid": "ccc14905-0933-44cd-92cd-f0b7c01a4967", "comment": "Malware payload (Mirai)", "value": "7b6dbaacc0a1c6341da8585f42037031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569569, "uuid": "fe6bf09d-0fa8-49c6-8b65-3b4f56ff1655", "comment": "Malware payload (Mirai)", "value": "1a3b4ba5071db779c74cdc7c4749490f9e3c7b0ccfe2e5c02ae3f41115ed67ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569569, "uuid": "282296ee-6ddd-43ea-b331-56405cca1df6", "comment": "Malware payload (Mirai)", "value": "f76106446406db2229e0b4b6483a231b992d55c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569569, "uuid": "bc5808d6-6d6c-498a-819a-9f481606efc2", "comment": "Malware payload (Mirai)", "value": "c7a31c2019ba5299d233f0944c02987416936c94e57de5fd10151549ffbe507a2600d6190952aea535d6c0ebd3680269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569569, "uuid": "6a5d8f4f-ea8c-48f0-9489-b522b12a7288", "value": "T15213F131F1A5AD27DD677FA54C16F7C0B3730F9FE35FA8929AD4295009B070B0212A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569569, "uuid": "d964feb7-a367-4f12-9ea7-908ef0bae595", "value": "768:3nlKSSUz94SKYgE0squkVK9Jyj/GOLnIv8u/Lgqm8uPrh4TKIS4uVcqgw09u:3nXX59kcK/tLHu0IuPrh4TTS4u+qgw0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569569, "uuid": "b0c4f3eb-f2a2-4edd-8e04-97fe27cf83e2", "value": 45508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569569, "uuid": "989d7114-64a4-4785-9bef-8fd51f6cd5e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569569, "uuid": "ed2cd75c-5b0c-4982-8852-bbf3f95dbeaf", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c45328d-cee3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764613715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613715, "uuid": "2e269e67-f469-476a-acb2-bdcc82c1b2fa", "comment": "Malware payload", "value": "70d557512aba670e4c2a1540ea82eba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613715, "uuid": "cefff077-c640-4f8c-ae24-f9ceb68abeae", "comment": "Malware payload", "value": "1a50f7ed40a2d047bb7a95eae650571dfee80694818dddc54a57e9f0a93617e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613715, "uuid": "25b5a97d-0e41-49c6-8dc8-69104496aba3", "comment": "Malware payload", "value": "76346efa0399f01d1b598ba4b7cd6cf7f1ef31e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613715, "uuid": "d91bec4f-7a20-41d0-a869-284886d80ec2", "comment": "Malware payload", "value": "db62952ebc4cf9b75383a644279ceccf43b6da4057b96f54696d5ea1b9d6b27664cead293c628e0e6d38b505902da03b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613715, "uuid": "29457f0e-8931-4f54-9599-e2b3ebc9fe4f", "value": "T1B873121623AD2971527145F1E7FE6F8CE10E3A688FF16C246C217C68B93236E5CD8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613715, "uuid": "1b84bbfb-1d6c-43d3-a74c-4d2b8ee07207", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3z:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764613715, "uuid": "f695a86d-3848-4615-acc6-599039d087fd", "value": 73876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764613715, "uuid": "ba114a1d-d95c-4831-8d72-5648cccf9b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613715, "uuid": "c9571cb7-de7b-4030-a035-ed1ae9b3c05f", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757c3541-ce9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584471, "uuid": "02bd7757-35ac-45ce-b630-6de6c0721790", "comment": "Malware payload (Mirai)", "value": "7f9462a7720facf62bdba1f1e5571eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584471, "uuid": "e4a3b5c9-f150-4ba5-a034-ac32d1599639", "comment": "Malware payload (Mirai)", "value": "1ad992dc46348ea8b3f36596bdbbee5a3629fd61270ab131613b07d4df38771f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584471, "uuid": "83236985-b0d1-4232-9033-814523de2565", "comment": "Malware payload (Mirai)", "value": "8930c21eb7198d8f2fa0ceb890cbe99cb8a3b231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584471, "uuid": "0d0c86f6-0f58-404a-9df8-77d1f2795477", "comment": "Malware payload (Mirai)", "value": "468e8b4931b56e1ed116dc90a08fa1277d9c1e9c62907c5e89c361cc620913767db2f9d61868ad72fb4b84d7f1311e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584471, "uuid": "cf719466-52ff-4be9-9b33-dc171967990c", "value": "T118A3BF47A5507EAEE4956D3F86438E26EF20CF604EC31B1571BAF9806A7D3903297E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584471, "uuid": "a17464b3-d0c4-4b61-afbe-e7c2349428f2", "value": "1536:eG8VJ1v5NzBiDLANsaO5tVcQUH71M2mbl/umOzlkQV4y+8rST:eG8VjtiHANdVQcTmbElk9UST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584471, "uuid": "5f923095-dea4-4a92-a024-3edafc07ef9e", "value": 106936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584471, "uuid": "b9aba344-e11b-420d-b3ee-bc6760e2e48e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584471, "uuid": "d6878685-3374-4de8-ad00-6fb0c4f4d168", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4896fa63-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620903, "uuid": "7647c6ac-dc05-4d4d-9078-52b6215ef054", "comment": "Malware payload", "value": "379217ac25edafd5154530452b7f7bbc", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620903, "uuid": "2464e1c9-d538-4beb-aace-d2f158a178f8", "comment": "Malware payload", "value": "1b2d716377268287bd48d76a6f8b6a92a4a8c416eab85e7f0ca2fc307664b57b", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620903, "uuid": "e2a22d5d-faa6-4a8d-95d1-041da7e6a9a4", "comment": "Malware payload", "value": "5ba85ad91d0a58033f7c30e2d4435bd0bd24cfee", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620903, "uuid": "764d039e-f1a2-4dfc-8348-d12f1205c2f3", "comment": "Malware payload", "value": "005040bedf757e6ec75bb47e00605a428351dbc8538ce0be2134f6c9b63c71b09ccca52c1142ce615b677aad8078e2c2", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620903, "uuid": "177053d1-6124-494d-8e6a-7103a6b636af", "value": "T166967C1FB38D40AED05DDD79BE168221EB2379528B24D5EF1A5C1B082E7EBD02B39351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620903, "uuid": "86c6a257-4d3d-40b6-a15f-a8f31d9f0ab5", "value": "a43a5655f09c33de22845d8432e4c9c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620903, "uuid": "1747bf0b-0745-48ec-b753-f423109f9167", "value": "98304:z0S5HSsfcfEMR8lCoaF0DeO3PF6t0TX/X1T8EdXo1TRKA0UCJgRfvqcSCSwV/N9:z5H+eHo0yoFi0z1TPAXggnLokX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620903, "uuid": "a734dc62-b490-4c93-bb51-721e47ca334d", "value": 9207504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620903, "uuid": "aeadc25b-6c89-459e-ae0b-f309d8e4fa81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620903, "uuid": "15f5de64-37b4-4e25-ace4-52c695fd2480", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de35f19-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764599866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599866, "uuid": "32ce11bb-9332-4227-a6c7-b32364d78c15", "comment": "Malware payload (GuLoader)", "value": "cbe72e93c04a891198f9dc0899244b3a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599866, "uuid": "37e90346-620d-4c52-88b8-f6470730c2af", "comment": "Malware payload (GuLoader)", "value": "1b71f21cbdaadb8658ac8940a4709df3f23dfc9fa6e784d50ebbc7a7888469e2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599866, "uuid": "4246965a-164b-453c-8b13-c96c0d1d86e3", "comment": "Malware payload (GuLoader)", "value": "d45a7cfa756ccac0d2bee7a2f8fd69f21ef17c65", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599866, "uuid": "a045e89a-3441-4675-8c77-bdf81a312885", "comment": "Malware payload (GuLoader)", "value": "98b9e339be083c9c2b368d44648d066d722b483fade03b2caf20d5c09243179a754bdf9b14d2fc6951a693a0b2faeb90", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599866, "uuid": "7c443b8f-eedf-4743-bc41-32ad1f2d73d3", "value": "T10DE12C02BD93717A7424424B7C1DD3CC389570D70A3216B831AF7639B9EBA28732D05D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599866, "uuid": "f76c668e-2408-4a17-b20a-e7b2b8278c3c", "value": "192:kBqWlLlYZHjJvtj6uaptnOna3cdIkiivpJM:Mqa+Hj36uaznOaqIQvXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599866, "uuid": "05ae61f4-ed5f-4413-a516-2fa0e6ad3402", "value": 6977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599866, "uuid": "ee89b97b-2772-4d04-881f-82bf0be5384d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599866, "uuid": "087d506c-382c-44ae-8c90-1310d5ac39ee", "value": "SKCMLT17622520986618485758458589457.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3b66b3-cec9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764602362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602362, "uuid": "bd8b4a07-497c-48cf-bdeb-755ebcc4d88a", "comment": "Malware payload", "value": "87f37fd7c2bbf257cc931f144b98870c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602362, "uuid": "7beb5228-13e5-4e07-8a9e-7beaee8d1c29", "comment": "Malware payload", "value": "1be67270c4b2515628f54e59664a1b3cddbe166f5e669e687be220885bfcf23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602362, "uuid": "98ed6813-f373-41cb-a37b-fed26bf7f796", "comment": "Malware payload", "value": "86296de2c87abee3ec4720fc679a29e403eb4a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602362, "uuid": "d7ff7af8-91dd-46f6-aa03-7c5aa1f29cb5", "comment": "Malware payload", "value": "f603b3f470bc76ead1f3a3b9f9fa5e5932fa42698305a01ce28128a6ce89cd57ea08e1cab1d6a51cc0936914fdb9519f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602362, "uuid": "917cc094-8c44-4f35-917a-07b73d915d28", "value": "T1355507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602362, "uuid": "6e24b2f0-b481-4b9a-908d-8d05f9c02019", "value": "7fa43c3f61c534e71055f4c9b34ddc48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602362, "uuid": "f31c05cc-1521-467a-b028-ec6c2839642f", "value": "24576:kdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:kQAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602362, "uuid": "33f6c397-fe4a-4be1-b145-de11dde1a402", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602362, "uuid": "1c3fe1af-1759-49f4-a7b0-402fe478d92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602362, "uuid": "ecb2c3bc-bc0d-47f4-ab6e-e5fde8540354", "value": "SecuriteInfo.com.FileRepMalware.64212946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90412d73-cefa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623600, "uuid": "029cba0b-503a-4086-b37c-bd62a8321aa4", "comment": "Malware payload", "value": "273292bcb013da821a207ae11078b81c", "object_relation": "md5", "Tag": [ { "name": "asgf-serv2-top", "colour": "#9EF0BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "superplaner-ok-info", "colour": "#7EB1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623600, "uuid": "e0a1fa26-be0a-4d52-9a63-2fd034a779c3", "comment": "Malware payload", "value": "1d70403a3a21713d4e799b356a96b95061aa764fa4e91c78ac8f0f7d3f536803", "object_relation": "sha256", "Tag": [ { "name": "asgf-serv2-top", "colour": "#9EF0BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "superplaner-ok-info", "colour": "#7EB1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623600, "uuid": "48660d30-8412-4238-a555-4dd4ed0cde66", "comment": "Malware payload", "value": "bb5cf1fbe8b2c18f13417e8b2f8392d22dcf2192", "object_relation": "sha1", "Tag": [ { "name": "asgf-serv2-top", "colour": "#9EF0BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "superplaner-ok-info", "colour": "#7EB1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623600, "uuid": "948a1dd3-b3c9-4f53-a494-bb1fb67d2b4d", "comment": "Malware payload", "value": "66d7d68f61469fe8b69f87cb0a06007875c610c8ebd965c6146b216102e8f279750f6cad54705ac7efedfbc77f127763", "object_relation": "sha3-384", "Tag": [ { "name": "asgf-serv2-top", "colour": "#9EF0BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "superplaner-ok-info", "colour": "#7EB1B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623600, "uuid": "e1c53717-e5a4-4ea4-af69-2ec187b64e83", "value": "T11FB50180B3D14063C8753E3C075D637E852C2AB78BE2998BE77C1A672D209D3653ED96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623600, "uuid": "d4c46113-fee4-4e71-9266-1b0990d9b366", "value": "73d081284d8a3dd7775fca114e673a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623600, "uuid": "5a695824-b6f5-47a5-8eb4-5609bc26c00c", "value": "24576:GX7o9/W3Xd5eDy6aeg3eOy7q+XPygTCnYGus+ZuG1G9EdJ0E:oo9+nbUroeTmysYGr+Zudid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623600, "uuid": "2569f269-eab2-4c83-9c1a-31710e31eb17", "value": 2462208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623600, "uuid": "7b2a10ac-a36f-4859-a8c2-20eab0c281e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623600, "uuid": "8f0f63fe-886a-4d29-9ee4-f82400ab96e1", "value": "zzzxvp02gf01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6745f2-ce7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569690, "uuid": "f944067f-3f2a-4c83-a8f5-b00df888a0d4", "comment": "Malware payload (Mirai)", "value": "033c38393a34a24482ca5ea7a2088281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569690, "uuid": "8787ed98-712b-4279-9d6a-9ca14cb8ae84", "comment": "Malware payload (Mirai)", "value": "1d986f09a0880ab9d1f09673144af5b3d58fe3c3e695f5fdaf09b5aa9c5245d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569690, "uuid": "27b56577-e13a-455c-8ff2-a6bbfe60d756", "comment": "Malware payload (Mirai)", "value": "992df4830d41e76912b110b0771cf067a85bd0cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569690, "uuid": "fe66b810-e4d0-426f-8bcb-aac42eb43b76", "comment": "Malware payload (Mirai)", "value": "a1c16193c5e31ad75a50c7da8a6f3e4c1815f825be854d7f7f8c67f360c3ba667e3005a4faa233c0bde22a3574cf7913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569690, "uuid": "c4836dbf-4a17-4ba3-b71c-e3db8d28c88b", "value": "T14233F1944550E2A2C7694C3FE7CB0BE50F31F08867766781677109CE6FAA1DBE40E9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569690, "uuid": "d136848c-16b1-4079-a3fe-cb1449d33332", "value": "768:0VPEFUoG3LZ3abs+FIjN05WNDvJq0R6UCg5oP1M6QwS24foagEdWd:EPEoZ3abs+SpoUJNbCXxNyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569690, "uuid": "30cec865-e7a7-4076-9d88-be43be0d32e9", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569690, "uuid": "70268b24-340c-46b1-8f21-51a5203f7ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569690, "uuid": "41909b70-11d8-4748-8c10-7b0f9a2eb36a", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0786af94-ce59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764554222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554222, "uuid": "c9a8a224-091c-48c2-9bec-bf2f8678f84b", "comment": "Malware payload (Mirai)", "value": "75ce3461a71cfaabdb0bd36f7dcd4591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554222, "uuid": "496e85b3-85c7-4ed6-81d8-0302408b94d1", "comment": "Malware payload (Mirai)", "value": "1df63bd8fa4e7025ebbb791fe9c8cfed928d7bc58b8c5974061a46ffb682fa06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554222, "uuid": "b9638ba5-cb4c-419e-8006-dd425b6eed37", "comment": "Malware payload (Mirai)", "value": "75e861ceb591a683f745126dc9e0c0d7a4888cd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554222, "uuid": "e2312bca-c421-43d7-ac59-d209b94502eb", "comment": "Malware payload (Mirai)", "value": "1862d2fa7590137f9d5b68279cc4a20bd82848d3b4659ce4809f02b54594333cf2272dcb8d5e36ec978b78b812c1a5da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554222, "uuid": "cc63fccd-1d79-4f62-8e54-788518283a3c", "value": "T12823F243A0ED1958E2BF203B6C9BBF872010EA59C397D41F528C517E7915EAD4E44B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554222, "uuid": "9afe7379-1062-4d35-b970-6a76bb1f7aa3", "value": "768:LZ+A1ENhFI6vR8IxA5w7YSe8Clp4PmkH/8jUEGBf7S3wN7eDkv1DXi78TNn3Ajn9:N+A1OR8IxbsS8p4X8jg+3wN7xiINunoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764554222, "uuid": "659fd7fb-1717-4db2-8ca8-399d4c03b5aa", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764554222, "uuid": "9080a312-d12c-4712-8e4d-95bb0c0a1324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554222, "uuid": "25cfe68c-6685-4e77-98a4-84b7ecaaefda", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9827e129-cef1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764619748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619748, "uuid": "bf3b0cd6-e1da-4d32-a8d6-16222c4d6fa0", "comment": "Malware payload", "value": "f9af802af26a2d560215bf30ebbc6d9f", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619748, "uuid": "f6ef758a-df33-406b-a100-3fc7a613167c", "comment": "Malware payload", "value": "1e0a49685187bfeff1ce4cae8673fe176cf9726b37fa0caf2a5dfdb2daba8572", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619748, "uuid": "5bb4fa47-5600-4ee3-82b7-66ab76fa1a34", "comment": "Malware payload", "value": "e235f709823f5d77c0019cba5b782541176033b4", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619748, "uuid": "1bcf238e-7512-484c-9814-906029443384", "comment": "Malware payload", "value": "59e51a2d337d0f89f4ba155b43aba9482183ffe9cd98f6825301ddb8699c331f7c71e0eae164754b29bcdfd7d54d4c50", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619748, "uuid": "ccef5dac-799a-4767-8f5c-4cf956062bb0", "value": "T1F5545C4977A440F4D9679239C9A39A46E7B2B8550770A3CF036443B96F3B7E09E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619748, "uuid": "7e132a72-81f6-4e48-b92a-e85dff16f72f", "value": "f80ba6eef721e8985abae16debca102d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619748, "uuid": "6855438f-ac51-453b-85e3-ced758106c7f", "value": "6144:8f4PTWFqXw1xidkiy2x2/hSTyC2fPJyTpg+q9kms:iTP2/x4JSg+q9kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764619748, "uuid": "9b740b0b-038a-4fbb-b5ce-7945d0c50a34", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764619748, "uuid": "bf0efac3-b7fd-4bde-a43c-5a68a4dd6a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619748, "uuid": "77d82847-6135-4b45-a5e7-4f14439bbfd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e408dc2-ce9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584486, "uuid": "1478903c-7ab3-45af-97b7-4f285165d672", "comment": "Malware payload (Mirai)", "value": "3380221108c4d566448f0e6f65b036db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584486, "uuid": "cb60e2c5-3357-4d36-8f39-87c9df261095", "comment": "Malware payload (Mirai)", "value": "1e1b43e2dbdc15844521426ce877abfb6a9730806c62b57761ded6de618acc2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584486, "uuid": "b17cc140-507f-4cb6-b6eb-fa3911c173f0", "comment": "Malware payload (Mirai)", "value": "bb7772b79e6e64e8324356fdac2e8616befeedb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584486, "uuid": "8e2f882a-12cd-47e0-9b6d-7f9f1e8335e9", "comment": "Malware payload (Mirai)", "value": "b39a339a494d2dc8be2b457265bcdb7834c98feaddf42c76b600aaa96857a76f40253084f414bda0ca7eb42942867cac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584486, "uuid": "e9c255e8-c37b-4650-8c41-6f936670a663", "value": "T12DE3E70EAE358F7DFB99C23447B78E25965823C627D1C581D2ADE6011E6038F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584486, "uuid": "a3fe2080-54e4-4072-80c9-731de2495c5f", "value": "3072:jtRKxKYZt4wY6bludObqRSQ81QywJMQXb22rP/UXan1mKJ1x3C8pepHgYMjDhQi+:RRKxKYZt4wY6bludObqRSQ81QywJMQXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584486, "uuid": "bed30dfd-8a6d-4ee7-9297-a1c8707bb616", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584486, "uuid": "f38a6188-35a4-4b21-b263-d4c0c0c2e7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584486, "uuid": "e0a52a61-0f39-403e-9c04-ef996388933e", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7598b0cd-cea0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584901, "uuid": "612d6607-f07f-4cd4-8ab5-eab52b049eeb", "comment": "Malware payload (Mirai)", "value": "67ec34c32db20541a6a8365692570d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584901, "uuid": "197d8b4a-43e4-4ce3-b9e4-8034d8adc3f0", "comment": "Malware payload (Mirai)", "value": "1f2185bf10cf8fa056273c5ee5d69b7b21743fb2374754b1414cf2486c5bc841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584901, "uuid": "4643b113-37a5-45f3-a1cc-ffb7c267e15f", "comment": "Malware payload (Mirai)", "value": "4e1171aa8905e99c28190206296fda85fa986a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584901, "uuid": "11b9e789-7f70-4309-8d87-401f1244ee41", "comment": "Malware payload (Mirai)", "value": "f80f679a2b86a36d5fb27c09f1fd1281572a2862c179534db7ab78e5142caee748a60a210d0ebe0eca372b37ac834093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584901, "uuid": "3ee266ad-3a70-4a74-9e34-a644b1168b50", "value": "T17AD38D69FE4FA8C1D2C7E37DED4A0FE2751778749665C0B10A00929FD9DAEE888D0217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584901, "uuid": "66409810-6305-4c5b-ab9c-cc52c440d310", "value": "3072:dCLzRj4xcDE77FcjdxwLc3zECLKUmKNGzPxE:spU1FcjdxworLKzbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584901, "uuid": "55d56cff-c329-4d37-bdb4-4b07e865e753", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584901, "uuid": "07e6dc2a-3338-44d1-a565-e57510a577d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584901, "uuid": "33100f01-877a-4515-8f25-217565e47800", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efde1112-cead-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764590689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590689, "uuid": "e57c7259-4293-4fb8-9fa9-773e46259987", "comment": "Malware payload", "value": "755c4afb774c33524f868a4c759dfc93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "revolt-chat", "colour": "#8789C5", "exportable": true, "hide_tag": false }, { "name": "stoat-chat", "colour": "#FC8EAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590689, "uuid": "21ef0e4b-2ced-4d49-9880-54624e1bf922", "comment": "Malware payload", "value": "203178b1ee26cf2dd00dd16aad7c7153c1c2eb2900e1d4be0739caac91d37f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "revolt-chat", "colour": "#8789C5", "exportable": true, "hide_tag": false }, { "name": "stoat-chat", "colour": "#FC8EAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590689, "uuid": "7616a924-ff1c-4beb-a96f-63bb1026589d", "comment": "Malware payload", "value": "d1cbddd664c6c76c60c9b88a4ca5bb01434f336c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "revolt-chat", "colour": "#8789C5", "exportable": true, "hide_tag": false }, { "name": "stoat-chat", "colour": "#FC8EAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590689, "uuid": "3acc1847-b5ba-4131-a2fa-323331badfc2", "comment": "Malware payload", "value": "12fab6e338803651dcf7234a6fee229d34613c55bda3a04d92f1df5cfb5dfc18e54e6e5649645fc1543ee6a4b1592605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false }, { "name": "revolt-chat", "colour": "#8789C5", "exportable": true, "hide_tag": false }, { "name": "stoat-chat", "colour": "#FC8EAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590689, "uuid": "48adbf0b-f360-4c1b-a9d8-5736860cfd16", "value": "T17C15233EFEC939B6C7A00D3A26AB57244CB46944EDD854CB4BD94CCBA4CEA42041FDB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590689, "uuid": "f7cf5b0e-e994-4e57-8a9d-bc0102402c3a", "value": "24576:v6ahdWgXAsZ2iPLsBg310I9ynAgQPXY8AP:xR/Aat052Y8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590689, "uuid": "54c27c0f-f476-416e-841d-3869888ae15e", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590689, "uuid": "1a45552d-8630-4935-8a5d-8014aca956e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590689, "uuid": "a98aa272-2a0b-4251-8c6c-f523d1939f96", "value": "me.loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0a321c-ce89-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764575140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575140, "uuid": "348974d9-d39b-4eaa-bdb3-25c1e3100582", "comment": "Malware payload (Loki)", "value": "328b56a48bbd89b049c4e33827f521d7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575140, "uuid": "f963f52a-f2d1-4c7a-9fdb-ab8374152fd1", "comment": "Malware payload (Loki)", "value": "2189d6b490727ce1c217392c9351a83745e26bbf3c4d503ca544febab64e9e06", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575140, "uuid": "7e97a049-0f84-40f2-bdc8-e61f7fba64cc", "comment": "Malware payload (Loki)", "value": "3e44764ccf7b963b1ae2f6686f5db8e7aa56d0c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575140, "uuid": "77f37c8a-7986-40d3-aece-b32b136fc96b", "comment": "Malware payload (Loki)", "value": "8291e1e047cde2d3517bfd02649026436a4f34b7f7a0c47c8360ae1665dab0762585639370b164803c54900b0184689b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575140, "uuid": "c049bed0-fcb4-4ebc-a018-b878faca3dd1", "value": "T1BCF3DF7835E5FC1AFCB080305FA6DA7EE75DAC14B9C2422716063F3C293A6E9871A745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575140, "uuid": "0fc17863-fbd8-42e0-a83b-733b0d990fc9", "value": "3072:jH/pTzyqtdQ2YJlAZiV8TtPABi76N7X872Rx8DI1uQ/UwQ4g9P7:7/pyqvQ3Jleik5ABE6VXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764575140, "uuid": "02d803e2-183f-432a-bc8b-2f17a104002c", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764575140, "uuid": "e008ba78-2507-4e04-9802-188a953b05b6", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575140, "uuid": "cb52a77a-2f89-41e0-92b5-3a53b957716a", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b94964a-ce81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764571623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571623, "uuid": "d2d47f76-c812-4389-a732-6f2d6b13f2b9", "comment": "Malware payload (Mirai)", "value": "61a0ee0b081782ba019ca45a9d51dc68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571623, "uuid": "e8f321b4-a043-41e7-b4be-970cdc1ed6eb", "comment": "Malware payload (Mirai)", "value": "21b2096177230f28589c5667b8b2ec596d5380acb5a57cb29650b1801e1d9f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571623, "uuid": "7e84b1a0-ce4d-445f-8180-1e1136d18695", "comment": "Malware payload (Mirai)", "value": "a62d2e64156a3382babaa9ec5ab20b90fcd34d52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571623, "uuid": "89813b55-6202-401a-8587-a3ea7c78200f", "comment": "Malware payload (Mirai)", "value": "f615c11b257387314087ed684bd1c68266e99e6c2dfe4bc22665e0636d2200b83d55647c6e61ad6aaa26dfa1846008f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571623, "uuid": "a58f4d27-a66a-4eee-b331-7ddac9c6c465", "value": "T121B37D21B4381E27C4E1947B22F74766F1F657D920A8CA1F7E720E8EFF256502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571623, "uuid": "aea8bab8-6f9d-4727-865d-59c4b3fcf175", "value": "1536:ZHIO8eULmvhQRTn7bn98OTgebNc9hf6aC9g+ZtMYN+XFs6HtaD3Ym5rYM5J5tAJ1:lIEroMHf6BzN+Wow7YO8R51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571623, "uuid": "cc7eaadb-abb2-44f2-b856-8c9a2ce76f2b", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571623, "uuid": "a392d102-def7-44ed-9477-b78dc4ef2757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571623, "uuid": "8ae29cd1-c2c7-4d31-8bf9-4126277f9bad", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255fbe16-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621273, "uuid": "37aa4b2b-b54d-4727-899e-fc5a6668f203", "comment": "Malware payload", "value": "0e644f8f210c21bf56753a269202bf3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621273, "uuid": "b2c26c8e-3de6-43aa-b267-ddecaeb3a1d2", "comment": "Malware payload", "value": "22605f5d5907d3cb1013ebabe9ef54fedf2b394f5f4b495d31f0511f44fd0058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621273, "uuid": "8505072e-10c2-4c67-aa9e-4492e3f553a8", "comment": "Malware payload", "value": "216650c61740c9710f77c5be2e8f0bf770a02bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621273, "uuid": "04a7e359-3d10-4d2f-b30b-7d025ade97ef", "comment": "Malware payload", "value": "244714c9a57a90e5dc132b0c2bfb8fbe72e4f1297aa6c11e540314f0883d846a5ca33a2aa1590c422b8387ef05c5d65e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621273, "uuid": "bbd6fceb-d463-4af7-8b14-3449267e3137", "value": "T13C7533B412E345ACCC352FF5948DC9459BE6AFE6B81D2107C027EEC83A01895B77BC69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621273, "uuid": "c64048cc-4170-4019-901c-efe8980e00f2", "value": "24576:01rN5+sTKED64pZZBGkpz2tkix24P8y5zDIDSBL5lREzJdL4rbmhJ3zerB3JE0I/:er2szDPpZykpyCObNSSBaJFMb+5QE0Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621273, "uuid": "2f661acb-b897-4ce6-b235-32c7ecb52229", "value": 1638320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621273, "uuid": "141b896a-f44b-4bc3-a1d0-be73b043261c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621273, "uuid": "d845a490-4a16-4bca-8582-f3714d5e277d", "value": "haachama.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13f7d0-ce9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764582923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582923, "uuid": "9dcea748-ca08-45a9-8704-8dff616e6203", "comment": "Malware payload (Mirai)", "value": "3ef31712874afed1b3ff0aaa92cd3d55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582923, "uuid": "c0fc260d-b320-4e0d-9b1a-f4d75fa966d1", "comment": "Malware payload (Mirai)", "value": "228c8ddb9b30dc73e1e2751058b857e5da6e05202385a67f671303a3ff21d4f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582923, "uuid": "b9b58df0-d3fa-49c8-9001-e4fc6448f5e3", "comment": "Malware payload (Mirai)", "value": "a837cb9926f6e7486481420017041c0f20340235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582923, "uuid": "ffd60c3b-9e12-4201-8fe4-d9f69b045ef6", "comment": "Malware payload (Mirai)", "value": "4fdb8ced9e6a9ba03d542efb99f651708e983bf8d99ad92f74bb071b4a5d62dbbe23bf01dfd9df834b3a57a289e0906f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582923, "uuid": "b139a72f-a577-4492-b2ec-cee4055de989", "value": "T158C35A81EAA3E0F1E18701B0115BF3E78A34E9345156DDD6EFA83970EC71A825D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582923, "uuid": "20efbb6d-b42a-458c-8f9f-4cf08f075692", "value": "1536:36syXG6Mo7miUWD1ONXvZSXVs5uVHSR87nUakxCP7Ug4qhPh4r9/FChdFgIVYl/J:K9XG6MjbRSy8yOLzzUePh4rdFCCIK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764582923, "uuid": "258db5c9-a5ba-4fa6-97e3-130a425ccaad", "value": 119452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764582923, "uuid": "bf8dffd0-86ec-4a69-871c-2d55adbfcfd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582923, "uuid": "c1a36780-063b-43a4-86aa-82385408d5b5", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34929447-ce77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764567182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567182, "uuid": "e064292f-47b3-4259-a9e3-3efd7fc922c6", "comment": "Malware payload (Mirai)", "value": "922092f6db8b5803bd1eb5e658e9dbad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567182, "uuid": "39dcf540-8b8c-4dac-b073-2676da1843ac", "comment": "Malware payload (Mirai)", "value": "23823ce5e4cf9235c3724f7bc173740c4ae46c9cec20b7434a3c642b3dcd211d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567182, "uuid": "bddde735-4049-42fa-a4b3-012979a42432", "comment": "Malware payload (Mirai)", "value": "dd8046c4ab9c0308dd9cb2a5fa6c6369436bef70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567182, "uuid": "3921f225-0be8-4770-9018-bbf497b084e2", "comment": "Malware payload (Mirai)", "value": "4e80fbd578caeaef79c487e047922c8f8601f7b383392f81a1f0928cabff18fb1fb533e43e912874b29d8be94bb403a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567182, "uuid": "b847e9c1-8bde-4885-b96d-6a6fa05231fb", "value": "T1F023F28FC5FE51E9E65E1037087DBFAB3415DC2C878AB19B118824AF7401F96196892F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567182, "uuid": "41bc46b1-5816-47ff-860f-b6a763859e33", "value": "768:qZ+A1ENhFI6vR8IxA5w7l5LvpEQlK4dvZGKg16WTjoKjXUSXunnbcuyD7UHQRjU:c+A1OR8IxbJ5Lv+aZwKg16WTjoKjkUuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567182, "uuid": "64edcc54-79ff-4e61-a568-68a5269ad16e", "value": 48420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567182, "uuid": "2d4496da-e3f0-432e-98cb-5276e3409e66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567182, "uuid": "44ce89c3-5981-427d-a2e8-31b64564a488", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6599b50-ce7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569601, "uuid": "5fc5738f-c804-4d79-aae2-cb4188f5554d", "comment": "Malware payload (Mirai)", "value": "a9aa2d0e0ee87afba7fe495134e909d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569601, "uuid": "2de3eaa2-0f66-4fa3-9e2e-3b6ee98c295b", "comment": "Malware payload (Mirai)", "value": "241e1f10d3b4933db2ab00af1d347f8dc028a7e7f5088075ba29d371f7243075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569601, "uuid": "79b61271-49b5-40c6-8001-ef6a84109516", "comment": "Malware payload (Mirai)", "value": "2cbefd961d863ff7b28cd5eac6baede49b7299dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569601, "uuid": "eb863c9c-dc08-4070-8b73-53c5f7cc2fbb", "comment": "Malware payload (Mirai)", "value": "18f2a0bc62bcd96c33c147b26f2f88f3b21669fba148711ef9e481cd87178dc8ad1694dd72f16788de2fae4831f43980", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569601, "uuid": "18573680-6680-453a-a28d-7101e8342924", "value": "T190B3494273180F57C19709B02E3F17F687BEE5E121E0BA89650EDB5A8675E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569601, "uuid": "d585dfe4-82c5-4435-8daa-61fc061a22ca", "value": "1536:gHXylSpMEscMYse9k1hi8pRbKLvYnAXVKDY9r+JuUqtBxHV/H1:8Xygpusk14+blW9+uVTH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569601, "uuid": "3f4fd350-9033-457f-89c4-ac3fd61dde8b", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569601, "uuid": "2c1c25c6-47b6-4bd7-a0be-facfff260c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569601, "uuid": "65c5bfa5-d1e3-4984-9e63-d24271b00cf7", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f344799d-ce86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764573945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573945, "uuid": "530f80b2-3329-4fc3-91d2-7f97ee8418ba", "comment": "Malware payload", "value": "af9c6a1650fa6f2d21aaeffa87982df7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573945, "uuid": "69597695-01ea-4c44-9bcb-0b6111b123c5", "comment": "Malware payload", "value": "250179b1e83c518c5ebbb55e6bfaf038eb69f1fb5c7358d57be4203d89d001a9", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573945, "uuid": "551c66f9-485f-4491-93dc-ad3dba12df34", "comment": "Malware payload", "value": "cb9961db80e9763f83ad397e319b05ea9bd3a39f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573945, "uuid": "87d35894-82f1-47ee-bf33-b256fd1ea3e9", "comment": "Malware payload", "value": "2c417fd705e9d0d5adb2597a478ce9e66821c33c60bf5b22faade58ff86a13dc50da78d819b64b524bcb648b79b5996a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573945, "uuid": "1ce70e75-329e-49ce-a8d1-612d7410ab62", "value": "T18403D7174C0C8E83A068C7E4BF471E5C3B662B0DEC867AFF18664ED63F681525C8952B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573945, "uuid": "a9d4f15c-03b5-4640-b4bf-4c37e13d2fb9", "value": "384:hwi1wVVcX8YbmWG3cdW0nwcP3r+8cQe1346aqvD:hwi1xMYbWWjPCTQe1346aqvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764573945, "uuid": "18cac252-9c09-4e3c-9f64-c482d8aa913f", "value": 38714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764573945, "uuid": "b31deb7b-5b64-4a54-a15d-784eb55a7912", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573945, "uuid": "6573f7ac-5b83-4ad4-bccc-495ca69a5fcf", "value": "invoice-1658768288.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcadde6e-ce71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764564887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564887, "uuid": "1c00baf8-ed81-4751-9364-c0b36f5806e1", "comment": "Malware payload (Mirai)", "value": "1e25df5cd6dd5ac5fd4f92febecae512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564887, "uuid": "662cc5ea-0691-48ce-ab3c-e46b935f24e0", "comment": "Malware payload (Mirai)", "value": "2580a0151f1ddf68044938a1c2e65fe3d39f916d902598fd88970ea48988a393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564887, "uuid": "fce09aab-0d1b-45ec-bbbc-131919e8754e", "comment": "Malware payload (Mirai)", "value": "eb08ec47135224348c19174d2fbe9b7991b12e15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564887, "uuid": "45ae4366-a83d-4624-b7ae-ce30e2b41442", "comment": "Malware payload (Mirai)", "value": "c423867a4184218a43c1fd7bfb7ee3841f70a835ec96887104e009117cd7eaa2dcdc29aea7a57b3e8620bde00056c188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564887, "uuid": "e624b95b-23d4-465f-9057-673c14f9097e", "value": "T1B5A3BF32C82A5D98C18505B8B4E6DE365B23E5C417932EF71AE6C7B65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564887, "uuid": "c0abc4de-de1c-4209-a370-3a4c68d2da11", "value": "1536:H/I9A0n3bQK05LKGVwS0KYqcKDFVut7DAQmHICwE6SPXc5:Hw9AkrqLK/KfDDwAQmHIEvvc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764564887, "uuid": "81c77a3c-a3fd-44f3-872d-384f51ccdfb5", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764564887, "uuid": "6289dcae-59a8-4085-b4d3-d4d54fa5b294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564887, "uuid": "c16e0d7a-1a0c-4118-ab9d-0eacbea7c9f7", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4131f5da-cef8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622608, "uuid": "bf0e221e-5a9d-4efb-8989-de9f25df32e1", "comment": "Malware payload", "value": "803cb2807731ff26689a3f07278ead98", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622608, "uuid": "127fb235-5c21-4d2f-841a-3c22fc245105", "comment": "Malware payload", "value": "25b8124f2528e7215681131830e5e901fa700658753367829bb49b6624c63788", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622608, "uuid": "73dd100f-656b-4223-ab94-5a0f1428ec31", "comment": "Malware payload", "value": "2d922abcb13074dc663a6f71fbd6fc8b2a792cc4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622608, "uuid": "109d35da-fded-420e-9bbb-79e8b04a3d65", "comment": "Malware payload", "value": "3292f9f8f48d3286f894d89ac498a5c1005226436b6c8ac82d338f710d38678ea289c1b60f7561a08dced241e4f7bfbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622608, "uuid": "43828f78-1cf3-4692-b912-c182051573a4", "value": "T1FF73734C5DCF85F895277CD849DF8C02F7E98603561CC6A5BE8DA9A42F4183CA1F99E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622608, "uuid": "0621f3ad-0c69-433e-bd88-8823590bea40", "value": "768:BhXAFT2GURZdAELOXk1eMdqWYodpPrDf0XH+DTQtrdzrW94Ga/WVsfHOr9iVy9zX:Ll16XodBousCQOwv2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622608, "uuid": "5ac6d4fa-a58d-4b11-b5ee-118385ef3255", "value": 77247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622608, "uuid": "9fd868c8-65a4-4e24-8689-5ea92eb17c49", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622608, "uuid": "53d82b75-7df3-4810-ae1e-47f07e5d5ebf", "value": "update1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286afb24-cef8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622567, "uuid": "e3b7c4aa-01de-487a-acc6-5a7db4f063b2", "comment": "Malware payload", "value": "e216f8dd17a752658c0474dfe1027aa9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622567, "uuid": "1d82ad68-8aa0-4495-8ab0-32e17e8f370f", "comment": "Malware payload", "value": "27cfcbf23ab69c6da03fc4d3d7fad8802f59d11feef4d0bc009d3d46b15eb256", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622567, "uuid": "1389453a-a16d-4d5b-94cd-5399b3366839", "comment": "Malware payload", "value": "ee3934f6a20aff1543385099f8ee14cebc8b1ff5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622567, "uuid": "bda0d2c7-26db-4f55-8b3e-02e9997ea672", "comment": "Malware payload", "value": "76a2f30c696f72bba24102f2e56140562b214702d861773f0a61aa5c17c4082764e30e27715ec22f2ca26dde9d013e79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622567, "uuid": "2d250421-c8ac-44bb-9232-9929eda59daa", "value": "T13EB14333E6835D1743D3EFA3C1F2DA2CBE6488AD91129FC5B0BC85815AA4E654384B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622567, "uuid": "0032f5d5-4980-4e00-a47a-436b22f35513", "value": "96:TdaeG7sw4xjgOzdpKJ7swzawr/fjedeAa:TQeM4lKzewbjAeAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622567, "uuid": "719653b0-6291-42d4-8a26-a8ac908ea151", "value": 5182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622567, "uuid": "c88a3991-a8e0-4770-b62f-7a9525796640", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622567, "uuid": "f0f1375e-a186-456e-ac74-b31217ef7fa6", "value": "styles.css.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6481fb6b-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764590885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590885, "uuid": "c7c1fe2b-942d-42e9-b232-98dc7aff516a", "comment": "Malware payload", "value": "6d493f3d23a7959db8f2399a3d4b42c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590885, "uuid": "289485f8-5dac-4b03-aac0-d68727885323", "comment": "Malware payload", "value": "285ffb70e45082c28b649c6ee99b51fce158beefbd625da30bcaa34d00ced861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590885, "uuid": "b1e67fb6-cd1c-426c-a9c5-90e29be20dd4", "comment": "Malware payload", "value": "4c50338ced01814b37d64f1a84be0c2c7af170f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590885, "uuid": "fd591962-b24e-428a-ae47-6b8ca4fc236d", "comment": "Malware payload", "value": "16b09bf742d07ff1a413f199d7891fb3a1dc72d661e62f7203168b5d8a981ec89df80f46184bb891e2035caa0d3d6bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590885, "uuid": "7a741822-19e6-456f-b1e1-816d963fbffa", "value": "T1A745235245AD5DDAC6691A3D303F6E141BD08E50C8DECCF98FE0AECA381BF119825F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590885, "uuid": "c74754d9-f2ee-4aa2-8e43-e3d1755662f3", "value": "24576:wyzfb8bmFy7UFBP5GAxvluEY9Z28ozGgRFCEHsrtZenQl0b6:wuACJ9i25DxMH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590885, "uuid": "e12410ac-f7a9-4b68-a9ee-f97b99e0ecd0", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590885, "uuid": "355933be-7596-422a-a21e-d8c29a51b39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590885, "uuid": "dc889e0e-5f90-42e8-9855-a9124a3d61c0", "value": "carno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857bad22-cea0-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764584927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584927, "uuid": "2d54ff52-dd16-4579-913c-02b6f995a8e8", "comment": "Malware payload (MaskGramStealer)", "value": "cf27457347122cd5a6c3005d77220b75", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584927, "uuid": "ad7511fd-a20a-4e2d-812b-60e6a8ba3698", "comment": "Malware payload (MaskGramStealer)", "value": "2943d6e28df3a7387a763f580790544fb56fae11cbd35fa2e13b8cba73fae277", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584927, "uuid": "77a038a4-dd8e-4b37-a91a-f99e04ded452", "comment": "Malware payload (MaskGramStealer)", "value": "8a9253e4326f9654d1921d01683bfc1e5e2fcea9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584927, "uuid": "707e7d29-d52a-4308-a150-daa16bdb42fb", "comment": "Malware payload (MaskGramStealer)", "value": "96512113ed2429e5d0a4ca112bd1f6beb1e2c9a98dc36d0ef66f0238b028bf96ae4b785975488c6547f5baadbf84020b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584927, "uuid": "f300fbf9-61ac-4f72-bd29-6788f89f3889", "value": "T155163822B954E1A4C1DAE138E464D2927620BC98273937D39F673E731D377D41A3B3A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584927, "uuid": "b29a2ee4-f6de-4a59-8763-5746f00730be", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584927, "uuid": "63011aae-6b96-492e-92fd-c1febb581020", "value": "49152:ZK5aWO9cPwpRHfDGHGdVxQGhLXme3gVIjxwg+MytFswD1Fk2t:sopjGVIjxzytFse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584927, "uuid": "67a1a4f3-b60d-442d-99ed-a86f26caffca", "value": 4300504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584927, "uuid": "bba6e62b-f76f-437d-b26b-4f8cc9f2a9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584927, "uuid": "76e97f45-bdc8-41e8-b8de-208b21914d68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345471fd-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764621298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621298, "uuid": "1e96191e-8853-4dcb-ba60-69f4ea7c8886", "comment": "Malware payload (Mirai)", "value": "7c6c928ec6ef6cf415b88f355d646ac0", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621298, "uuid": "4e4db081-f9c3-4fa5-9072-7a41512c87c4", "comment": "Malware payload (Mirai)", "value": "2a66f597ee9bf3c1dcac047ba02afbb90e0adce6e7e553cc0901c78f37c6c7a2", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621298, "uuid": "0c1fa2b0-d6d1-46ca-8329-830b0402a457", "comment": "Malware payload (Mirai)", "value": "9087eb96dd2d7db189fae73375e949f3b12efaa3", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621298, "uuid": "8dfdb260-8195-47be-ab1d-70b14366abac", "comment": "Malware payload (Mirai)", "value": "880a5ad5fd04b613dad3e55e4c446220fdf16c0e29f527f0c5096b2140aa81da442b6f32a7a02fa7567b60e809b8c587", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621298, "uuid": "b07a9d34-4c0f-4ce4-a536-c3cfda373ecf", "value": "T13A661862BF58EE1FD29531348AF6C27427D53D1081A120339615FB192FBE2B89E1BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621298, "uuid": "4d384018-8fe6-4bb1-87ac-b7904562a7e5", "value": "49152:MQYLONGf1zpMehYskIgqYXjRtbvuJvHrHHEt5E8:MQMpVutqJvHrnEjE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621298, "uuid": "d6884c19-9649-43db-850f-318ac933d7b4", "value": 6684820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621298, "uuid": "c5e41647-b680-425a-9f16-1a32e5e08759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621298, "uuid": "5c7307e7-195a-48d7-9ff3-a2d810e94800", "value": "shion.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d993116b-ceb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764594947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594947, "uuid": "b0fa6717-6e2c-41c0-b1a1-644e321550a7", "comment": "Malware payload (Mirai)", "value": "4f2f1bfd473d878591b9e7bc9fa74679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594947, "uuid": "d999a95f-8852-43e8-b932-efcac513253a", "comment": "Malware payload (Mirai)", "value": "2a93b7b2304e587fb714218890b5b90a0f6e3a593a4ab9d4eec975cb1a37ac4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594947, "uuid": "228c8762-5e13-4794-9727-378c5e71b136", "comment": "Malware payload (Mirai)", "value": "9c9700c01e3d289c15a2784a2595f7cee6fa603a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594947, "uuid": "ee02dbc7-52cd-4ef3-92c2-0d06cc31c64a", "comment": "Malware payload (Mirai)", "value": "c421ad0860588b35a9f39be49043004597bfda78e8bad83b192589b27ea8210ca4598ec40de8df15bf2beb53a3fe4c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594947, "uuid": "58cdcde1-3163-42ed-899a-b3572cad1f61", "value": "T139046289BF913FFFD81ECD370295DA0512AD890A52D8BF772A74D508B68B10A59D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594947, "uuid": "bc1b452f-45c9-442f-afb0-20c8355615fc", "value": "1536:CE6jTAA0ejdadOkbDrW7xvCBuLn9DD5uMEl1vNh2lr:CEU0A0CZ7xUc9DDaNh25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594947, "uuid": "bfaab717-f831-4d3a-b74d-890037d416ed", "value": 179848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594947, "uuid": "7ef68183-6762-45bc-8d7f-742d228083ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594947, "uuid": "6ad9e389-6adf-4733-b7bb-fc48f2f3edc8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d60df-cec7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764601576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601576, "uuid": "5b9be0ed-6e63-44a4-950d-f7e6ffdaadc5", "comment": "Malware payload (Mirai)", "value": "ebc7ec7b61971c3ff5b3675b1140e8dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601576, "uuid": "eefb1e81-240d-4e7a-bbe0-41f37eb4f87b", "comment": "Malware payload (Mirai)", "value": "2aa06b7de7b4b63fa138c9dbd4f87285b257a9e7535b4dd6b11c5f8ad4deb8ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601576, "uuid": "c1d94055-d8d2-47a3-a64a-9c18096f91c9", "comment": "Malware payload (Mirai)", "value": "5d72e5aa840cef82226e7e451dd75d46db2c7168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601576, "uuid": "83468a1d-ce8c-4044-b782-e17145fc440d", "comment": "Malware payload (Mirai)", "value": "67aba0e568b46a936bd48e47bdbd789452b8ebb81b1c1d5e8f2f3cb0bc6724d9fca86ea57ca31fc26f668815ca451844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601576, "uuid": "5c0733af-6e5f-4e7c-b830-38d1baa19fdf", "value": "T1A4E32A45FD504F23C6C612BBFB5E428D772A17A8D2EE72039D256F20378B56B0E76142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601576, "uuid": "bea783d6-80bc-40ab-b41e-32ef8bfa339a", "value": "1536:5X1ISXbQQ4TfijNK5vASbdTqc25Ma4V3o5mTwhoabGodaOZG1+tl1lwywO1I9Tmy:5XDXwfrpbtqcm4KQchoabkT1xlQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601576, "uuid": "1851eeab-f4f6-441e-ba40-171f91a3def3", "value": 146016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601576, "uuid": "ff792148-c751-4ad9-b12a-785366261c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601576, "uuid": "65a41a9f-cff4-4333-ab73-3b18927c3c38", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a43fe3b-ceb8-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764595216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764595216, "uuid": "c503253a-c751-471d-80cc-929ec4eade3c", "comment": "Malware payload (QuasarRAT)", "value": "249772e2775e0a0fc9ee97a405f400d4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764595216, "uuid": "3ba43c09-a339-49e1-bc9f-232d14bb833d", "comment": "Malware payload (QuasarRAT)", "value": "2b898bf38a711353085342e8486d7078589ab70b39247179e797fd395eafe84f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764595216, "uuid": "61b6ad22-d32a-467c-bd9a-5daf643260d5", "comment": "Malware payload (QuasarRAT)", "value": "0b0af85e72687a05579b0ff83048242cb924771d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764595216, "uuid": "2eeae40b-506a-4437-832c-d17531080972", "comment": "Malware payload (QuasarRAT)", "value": "d7262eb88ae71159f4fafada198224e8866fd0939880d35a58c0ec7d71371bde93a82e27b7a1274f71ce9acdfc466ec0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764595216, "uuid": "020a8e76-46a8-4710-9715-b44aee2c2152", "value": "T15145D02855842FB68EE81B2C70BE053EEBF055CA6015A845EE3B7C6D6FE75C8070F4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764595216, "uuid": "c2501779-f1be-48d4-b6a2-70e09ec0e9ef", "value": "24576:/C+pK1afQdiPpHWLC+KTeaKTpC26Vfee9FUTQPJwKAY:911kGJaeUVfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764595216, "uuid": "5cc213dc-39d4-45d2-bd38-4dc92b9cab61", "value": 1197822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764595216, "uuid": "5e603bba-a7d0-475f-8c8d-b65c559a770d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764595216, "uuid": "c76058c2-ed12-482d-b8b4-369afd990a87", "value": "kryo_crypted_0ow5ljsy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c7a1d8-ced2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764606245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606245, "uuid": "da57641c-16f0-4677-bed6-04dd91aa8f0c", "comment": "Malware payload", "value": "77d9b24fe32f2e87d9a08c8cb2449631", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606245, "uuid": "ed68ed52-323d-48cd-b788-0cb0f048b783", "comment": "Malware payload", "value": "2c4a48e79aa8029ebfe862c970693cd8001fd8aa5ee4f4505bf0209e663da071", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606245, "uuid": "86cb15f8-5d70-4fba-9f96-6f6f2ea9017a", "comment": "Malware payload", "value": "33fded02310eda145d9068011de874f096c7e39f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606245, "uuid": "e38d2f94-fede-4761-8ea8-30a026675ca0", "comment": "Malware payload", "value": "060641b65ac4190c9c979bdf73a8d0b2ca57ae8c9cdb7b7e846f91f5ecea1160601f47da4497a0a92b95e8f50517fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606245, "uuid": "ac290afa-43c0-4b82-aece-a9b856479846", "value": "T140011ECCB2F135735E41CE38E1668E5C9430A0D536B38A16E9F439F8C5DA200B2276BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606245, "uuid": "96b12806-11d2-4379-b7d1-46c092439a96", "value": "12:3J3RBJoYVZNIl5EC0LKmpE+OQJpjMVSjT535sSO6JNtnSQvrJ9bR:3J3uYLNI7OKz+XTjnT1Cl4tSmrTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764606245, "uuid": "856868ce-48ad-4ce7-9d3d-2d91a21fa184", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764606245, "uuid": "02a15d63-e492-4e27-8bf7-1ba219fe879c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606245, "uuid": "ddbca02c-00a6-4513-be47-c89ed15ac251", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032a85b9-ce5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764555503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555503, "uuid": "91449923-1630-45bf-a5f1-15a2ee268be6", "comment": "Malware payload (Socks5Systemz)", "value": "81d750711fb341af531f83d19fbf2dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555503, "uuid": "b4ea0f9e-91d7-4222-9a62-eeebd9055aed", "comment": "Malware payload (Socks5Systemz)", "value": "2c710a6ba0ff703015cede2d55e22ff5a8870c6db3e432a9858ecae5c113477d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555503, "uuid": "f56658e4-7fdd-4eef-b8c0-5554929861da", "comment": "Malware payload (Socks5Systemz)", "value": "104a3f68aa11358f686a7cadf7da031f74a28335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555503, "uuid": "e6bc2dd0-d9dd-4fcc-ab0e-2a97b5a0a6c0", "comment": "Malware payload (Socks5Systemz)", "value": "11c447c24794ab8822d0dae421754d68a51fb3bd56ae4597b35cf3c4034e4b37be53df6e304a240bf76880a53dd9409a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555503, "uuid": "20ea8274-f738-45c1-8d8a-1edce4247dca", "value": "T1EE063385CE2109BCE0338E7E6B5E01411C7AB8726C8B744A22F7AE5C8F79775471EB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555503, "uuid": "9673cd45-898b-4a89-84cd-e42dd8bd835e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555503, "uuid": "ab854cdc-f245-474e-b489-1d7f4b5c1d4e", "value": "98304:MtQwsNhgpOvsnRCeZaMaO6apwyiYUFt8qyQ9HBNda55y94B:4QwsQFb4p5YcyQ9HBQ5LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764555503, "uuid": "90620034-512c-43ad-902f-aedf1e11cd90", "value": 3877156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764555503, "uuid": "26ae9eb7-5f32-4a41-ab1e-9d0f109972e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555503, "uuid": "05aa73d5-8adc-4bc7-a724-414dd234b892", "value": "SecuriteInfo.com.FileRepMalware.61469239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df65a58a-cf0e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764632323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764632323, "uuid": "3566198c-6275-4d19-8833-3d74d568e5aa", "comment": "Malware payload (Mirai)", "value": "545063c54ab8e1c4db7187153f88bf2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764632323, "uuid": "b31513d3-fed4-44d3-8dd0-5075b1138a59", "comment": "Malware payload (Mirai)", "value": "2e41ba222db8e2d8c63326775ee7aaac969cb736fba896e19d123e99bff97e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764632323, "uuid": "adf3beef-a977-4cb7-a1ee-2da35d1905d8", "comment": "Malware payload (Mirai)", "value": "29e5e782403102f3ec6375d0784408a4168b98f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764632323, "uuid": "b41675bf-5b2e-4e3c-b01a-04324b89f112", "comment": "Malware payload (Mirai)", "value": "5651439d1537184f34b3a4c568dfa51ab0a1075b2aba3cf02da59ed71dcd65c89aad5cffe91ee878d7e344d41feada96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764632323, "uuid": "80cdd8fe-7542-4617-bbd4-b42073257f00", "value": "T15AC3D80D3F219FBCF7A8923507B78E269259338637E1D181E15CDA016EA038E645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764632323, "uuid": "5fe5d25a-9a9c-4a00-9fb0-e9850c3ac479", "value": "3072:KlxLIzz7CkDvBigUlzM6eWxBBK5qCSAgxBle:KlxLIzzukDvBxW1e+BYhNee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764632323, "uuid": "94d12eb0-82d1-4d0a-8248-a15260625b3c", "value": 126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764632323, "uuid": "0fa07fce-8a9b-41b6-81d5-03623c632ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764632323, "uuid": "b317b491-bbb3-44b6-a72f-2ae963aa069f", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fae59e-cede-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764611372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611372, "uuid": "7137a5b8-f1f3-4313-ab85-e672918995e1", "comment": "Malware payload", "value": "43e8f395d4a9344fd8d1b3acef8d7012", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611372, "uuid": "d6ef7f16-d6b9-416c-851d-0c27db3b2c9e", "comment": "Malware payload", "value": "2e5934e38666e63c23f5906e5175a1bf5c230972cb57bb8c07dab0630921fa43", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611372, "uuid": "36fe607a-5dcc-422e-8e5a-0eb18e18d716", "comment": "Malware payload", "value": "6fbb205171af1de8fddc010171199a7a26c24c3d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611372, "uuid": "08ba4e31-aef7-4093-a8d1-f43f1fef91fa", "comment": "Malware payload", "value": "ff6159254848492060fba91ab852ca3e8fd81f9167c88b614f4dacc24148e7400efff092a7d3d1131f3efc730f4570ab", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611372, "uuid": "d0f35c27-39b4-4790-a1bb-503a98f927f6", "value": "T13673B69A0EDBA4F8A92B785889DF8C05E7F5C403161CD5B1FE4DA5E13F1282C92F95E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611372, "uuid": "9383e0f1-219a-46fa-86cc-3b89c14140f0", "value": "768:3Y80tXO4gj/bjsPNnIiyj1b+k4l1yfr7TNKWHTEQg8EvCV1HIzRwD2045X1CHs/T:31C++k41G9BUXusJKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764611372, "uuid": "ef60f9f4-20b2-452d-8980-5e0bd62e5c93", "value": 76311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764611372, "uuid": "73336cef-9952-4ec4-b4b9-4f24b0a55b1c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611372, "uuid": "c5661260-de40-4cb9-b035-aaba6867ea5c", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c66a07-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608709, "uuid": "a47d73e0-7304-4182-befc-1de41acb2a4b", "comment": "Malware payload (Mirai)", "value": "1e698e9991582bab80554e3d5a0a0f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608709, "uuid": "52e96998-905c-4af6-a008-599195b27d40", "comment": "Malware payload (Mirai)", "value": "2eab813acbebb4902abae47d614bf95a14b3227f95a0f8bc45013fa5dcd77ec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608709, "uuid": "414e8323-f069-4fd3-b151-7cb0b8c2d9ac", "comment": "Malware payload (Mirai)", "value": "279a0f3b0ca5a4e46f853512fef5f3d82d533a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608709, "uuid": "cdc80d29-166e-4fd8-8d71-465ed518cd9d", "comment": "Malware payload (Mirai)", "value": "bb331c61ed42990b7e2fc645d0206da22930504628ecf3a0fe0fecd816beef3f3b38cdb0894f8f8eb7422ab9bb5592ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608709, "uuid": "c3651b71-dcf5-403a-84a2-d67bf10fad56", "value": "T165E2F141619515A3CBB02DBBCDE59AC92F0D2CBCD0ED22A322D9829DCF326817DF554B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608709, "uuid": "e28b3c3a-3f12-42a4-88ea-eacf79eb9309", "value": "768:OIPwf++dz+o3l3tJ8dcaJvmFdgY2YtT8Zo+EvV9q3UELUS:OUQ+8z+oZtAlW2IT8Zo+zLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608709, "uuid": "d757e58a-0a6f-4b66-9b6c-a5414929e9a3", "value": 31772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608709, "uuid": "b6501196-0d8a-4e97-b66e-5d6264f439ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608709, "uuid": "6de4f195-4bf9-4973-8cde-36dc9ee1ed56", "value": "niggah.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a0465d-cecd-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764604278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604278, "uuid": "205a2fad-a3e3-4944-8960-c299c6c8e8ce", "comment": "Malware payload (Socks5Systemz)", "value": "51a484f76c310eb52366b334c4253957", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604278, "uuid": "61f92dc4-1ccb-4e38-84be-63018825289f", "comment": "Malware payload (Socks5Systemz)", "value": "2f303155b27b8a3bdc4071a9b28d21064a260cf8a4acc86005efd4063f2b0285", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604278, "uuid": "023a672c-0474-41bd-a82e-f92372051eed", "comment": "Malware payload (Socks5Systemz)", "value": "745149815c0ce286619915c00083504227463360", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604278, "uuid": "040e2337-2016-4fc9-a122-07b100cf7853", "comment": "Malware payload (Socks5Systemz)", "value": "7309b56bfeeee985fbff17f64af45606892b0916c19a47cdb8a24a4c2ef02fbc39cf7c297dbc2079656ca666d98e570c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604278, "uuid": "d5b3bc82-2e96-447c-9225-6d74e7735ef8", "value": "T152F53312B2876836C2A059B7E7448A95FC3EAF1E1CB49B5A5D880F6CCB379E1C50D346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604278, "uuid": "e9485c6e-e376-4a11-b758-8ace627e480a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604278, "uuid": "10c4807b-fba7-41ca-8394-7520dfd706a9", "value": "98304:Mr89Lxu7ldteHOoXj87ZJhxcqtHXsACh/mVO1wYUz8B:Uck7ldMdub1XJwmVUwNz8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764604278, "uuid": "b7152a46-cd7a-42e9-abd8-b3a68857621d", "value": 3340228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764604278, "uuid": "bf4117a4-05b7-4eb6-903a-ef95c09f7232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604278, "uuid": "a667f5b2-e90f-4f13-9002-76df7cebfe5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a88a6df-cefd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764624772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624772, "uuid": "8fdc8976-802f-4059-aa3f-921fec6ab618", "comment": "Malware payload (Mirai)", "value": "e4d08b2b5dc2c6738b51e4b56ee4540c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624772, "uuid": "330c4ead-e25b-46b2-a406-6ebff7e8f883", "comment": "Malware payload (Mirai)", "value": "2f7cda9ed1d3684ae4fa2731619949bc324b8a735e80cd0bcd886fae5b4bf566", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624772, "uuid": "b9e3efe3-e8f2-4d9a-a097-9a062137c46c", "comment": "Malware payload (Mirai)", "value": "ec6988514df2351f0b0fbaf91c3cf8c350a2b8a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624772, "uuid": "ecd1e9b7-cc00-4dec-9bf2-b7969e0207ee", "comment": "Malware payload (Mirai)", "value": "23ca954419162be4bc55d4e040771ee9c14b417d97e16100e08b428091e9569b92e3d373d15441d2a527b041f814595b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624772, "uuid": "49d804bb-6a22-4d98-9a56-9689a37d1f16", "value": "T1FC837DC49687D9F5CD06467561B3EB338636F437222AE983D3D89A23FC53A419A072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624772, "uuid": "e4185273-dd53-4f74-b31b-2daf7b36aa16", "value": "1536:6lATE58h0hGZuf/H04AZBCyajO1sL6M3hvZoPT2bfbhRWoBh1gcASCj:6liE58h0hquf/H04AZBCRa1sL62RST0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624772, "uuid": "72c5e51d-530e-4575-a213-f11afe662c95", "value": 84272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624772, "uuid": "469fce38-979c-424d-a0eb-0cafe1bd6fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624772, "uuid": "5321e2b4-5d3d-4207-9115-abfff6ac50f8", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0034b55e-cea8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588140, "uuid": "b46f72f3-3af8-4376-b620-95ecc60efe31", "comment": "Malware payload (Mirai)", "value": "a672d2ffa8a19a4759e0f9110dfe6957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588140, "uuid": "d51e3868-78b1-4f78-aa9d-28a69448d7a0", "comment": "Malware payload (Mirai)", "value": "319265cebd44304d49efc61e8b9d3b3fa4cc299af80ab66c5bfba86024ffbe50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588140, "uuid": "959fc967-7946-445c-a073-ccc700e0ad58", "comment": "Malware payload (Mirai)", "value": "72e0334a6e4b9a688b6427d3629a9a001447b461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588140, "uuid": "8ab571df-6773-4ab6-80a0-c1d3e44206e3", "comment": "Malware payload (Mirai)", "value": "7a2891d87b0e4eda73a14f0b298d3dc7105f2c4a49202167436ca355d1f5245225301978be0b000551dd9d5d24c4eb34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588140, "uuid": "553b5ecb-eaae-4d71-b9f8-fd45baf97886", "value": "T1CF144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588140, "uuid": "eb5b8ffb-0298-4625-9c6a-06c9a3d5059b", "value": "6144:9MygR/fQdiYnxN4aTBMvlZe5cgCHMhCm3r5M/9pTKF:9MBR/fQAgxN4aTBMvlZe5XabMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588140, "uuid": "f1f1a57d-5d7b-47a8-9cde-4455fd04a1f6", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588140, "uuid": "d8da4147-7bde-4a5d-99b9-32728f784146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588140, "uuid": "ecbf99dc-8dfc-403e-835a-72d4e53c7925", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22be0c86-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621698, "uuid": "dc2bc13f-171b-4f92-bc4b-60c0d3209811", "comment": "Malware payload (Gafgyt)", "value": "08ff7fdf345a1df3a3cd7ed8c2ef0197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621698, "uuid": "308b0049-b70b-4e8c-beb3-971e0066f3a6", "comment": "Malware payload (Gafgyt)", "value": "31e40894c61560ec29d23fe6a32591c82add5acbe2de7b5f23c1b81e454cc47e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621698, "uuid": "4a5cc2b3-2e99-4c0f-9d03-36d1a98aea41", "comment": "Malware payload (Gafgyt)", "value": "06152f2db154c0180c9fbb89d0c623def33ae537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621698, "uuid": "447456f1-f295-4307-a7b5-7fe2eb1f900e", "comment": "Malware payload (Gafgyt)", "value": "72bab30cc7985014e5318269ab28b8fda0b7e5d9d01e61b4dc273beff18aefd0bdadcdad1ea83faa710c21efa763d357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621698, "uuid": "cec517a1-ebda-4679-8875-715f208a5668", "value": "T1BAD3E876F401DFA6F00B96B104D78F216E30ABE30B9225167366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621698, "uuid": "c19b95fc-d999-4c44-bae5-7351d82fbe0d", "value": "3072:VLAkBYJjsod+AswTuyDXrGSrQ/MyQ1UJ3STgEmzj0qDJNYyoPe:VZoxTuyDXr7yQuJ3STgEmzj0qDJNYyoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621698, "uuid": "a8d31952-28de-42a4-a1e1-a33ec1a60f78", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621698, "uuid": "7132f495-fce5-4792-a3c1-8a11dab05083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621698, "uuid": "55ad045f-7c6c-4324-aa41-83b8eefff5d0", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedb48f1-ce89-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764575118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575118, "uuid": "a650102e-7473-4c9a-b64c-0658c6b524d0", "comment": "Malware payload (RemcosRAT)", "value": "a236d1434c6f20339ee63a4a40d69f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575118, "uuid": "8e38ffbb-90cd-4c2a-8c41-7472dd2222e5", "comment": "Malware payload (RemcosRAT)", "value": "32319bba064a74661289939c7233cd94e581c29281c8f5831e8d0b5ae26e9341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575118, "uuid": "57bf8121-5482-4ee4-8ce5-c82413858c62", "comment": "Malware payload (RemcosRAT)", "value": "ad697a0d1e9a1d27619c4cd7014d4dc0aa398ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575118, "uuid": "d3a41d33-9d85-4f71-8988-c47c81371513", "comment": "Malware payload (RemcosRAT)", "value": "c5b83900518fa04b76785f048e0930bdc1376dba2803ebd1a9d7acf0d11e89013be304381e5d5f1beaf3f0fadd547a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575118, "uuid": "f2c03820-8ead-4781-9912-b1bfef6f8c07", "value": "T104A413127BE0CC67C0B259314A3D9A36A8BEED76281693573753BF4CA936311690F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575118, "uuid": "5adcff42-7d76-4ab7-8a35-bf1f769bbbc3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575118, "uuid": "748f5e07-5bf0-4276-a0e6-9addb9ee8442", "value": "12288:QgfN6G3lE4i4XJsOMWl9kGdMrK+81udphFmyrc1xV7W2jUc:QgfAkXi4XhMEPdMrKIphnyxV/Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764575118, "uuid": "833a3704-54f1-4810-8c92-4e27d39fd806", "value": 482216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764575118, "uuid": "586feea8-2a2f-4a98-a27c-62e8872527e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575118, "uuid": "fe0c423f-882f-43da-afbf-3425037d5506", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed37c0d-cedf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764611840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611840, "uuid": "e9047f63-b9c7-4b71-979d-ef38f1873eaf", "comment": "Malware payload", "value": "f5ad5fac55be72782dc95eebbf5ec72e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611840, "uuid": "5c842fae-6b67-4e50-8849-f269ce5d656f", "comment": "Malware payload", "value": "327f192be941e359566984774f3eae57111a0de6835a8d0acb83f05fe7ad46a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611840, "uuid": "70bd013f-b697-4a01-ad7a-d9904a3eae95", "comment": "Malware payload", "value": "53d7d8fe88e87cb1f3475b16e5149a500d321d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611840, "uuid": "67ff49cf-e03e-45d1-bd77-a8f7c48728d6", "comment": "Malware payload", "value": "b2c7f82efe37d9e15f6064bff73325254ecf6379f23fd2e045596ff02461382f429ce7692eea91ea56fd62c26aa866fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611840, "uuid": "127e2d2b-1cba-4629-ac30-9ef830bcb36c", "value": "T11906332F54F21ACD10D1F42EBB5233C5F471C85A9DB7182CA1AEF4694DF2EA942807A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611840, "uuid": "ecdde59c-c480-4aea-bca6-fdc4bbe7bfe5", "value": "98304:bXHbaVYJo5n8uZ0e1ErADECHBp1rWYnZOFs8ed:bXHbboz2rAICEq0Fs8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764611840, "uuid": "1e2fbbdb-bf72-4dec-a6c5-3d963e6b63e7", "value": 3768628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764611840, "uuid": "5fc21f8c-895e-4450-aa4a-f63cf5a5a3c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611840, "uuid": "3d5a7408-2e79-4ac9-afef-23e1df1876d5", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666b30cb-ce75-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764566407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566407, "uuid": "7097288c-bb7b-488c-ae60-5d452bbae164", "comment": "Malware payload (Loki)", "value": "b83db7fd41187833d7f3dca59f9de0bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566407, "uuid": "b7f5d783-1768-41f6-ae6f-c02068173faf", "comment": "Malware payload (Loki)", "value": "32a52586e742cb7d213b9eb5b2c6038f26d8c647a092ee8b23ff2fb94deaff57", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566407, "uuid": "3a06ed3f-43f2-458b-80d7-4656c1aa0368", "comment": "Malware payload (Loki)", "value": "d276edbfefb5e6b6041f038d8acdb2bd53b499f2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566407, "uuid": "a4b9ec44-db7b-4df2-b21e-6e11f2dc48fe", "comment": "Malware payload (Loki)", "value": "8bd83244c50e7dd1f6fc9d90ef0ccec505335fdaf401dc362b5a08ab99fd2b80839f34191462627848bf93a94b401a4f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566407, "uuid": "eb7681f2-2f01-4ad9-8b85-8271ee23040a", "value": "T19FE3CF7839E1FC1AFDB080305EA6C9BEF72DAD14BDC2412712063F7D193A6E98716649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566407, "uuid": "88be1a98-111b-4297-a584-1f1d51da4126", "value": "3072:aH/pTzyqtdQ2YJlAZiV8TtUsi76N7X872Rx8DI1uQ/UwQ4g9P:U/pyqvQ3JleikqsE6VXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764566407, "uuid": "66d546e9-f405-4cca-954b-706ae0bb1ec6", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764566407, "uuid": "a708b132-7f21-494a-a059-60dbd437c52b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566407, "uuid": "024250c7-77b1-4040-8bdd-4dcc22bd95c3", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c346a7-cefb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764624087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624087, "uuid": "155f88dd-4f5c-4644-93f2-ddadc5808f3d", "comment": "Malware payload (Mirai)", "value": "0880b70aa35fb5e74085f94e3809891f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624087, "uuid": "de9b253c-1eda-444c-86d8-512be991eb56", "comment": "Malware payload (Mirai)", "value": "33147cc61aac5852fd5a8014314a886f807734fc1f8b61119f75cf8540149635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624087, "uuid": "0f4bebb9-7bf4-4042-841a-6fa9e42b442f", "comment": "Malware payload (Mirai)", "value": "65a8209982c7621ac33f28aaf31a298b9d601cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624087, "uuid": "53b4c695-3f62-43f8-b5ff-8cb5647c343d", "comment": "Malware payload (Mirai)", "value": "51b7a2bda619da05f8d90a774d6d26832d38ab159b42027deaa9953e56223ff148b21e448220a462b3dd714945976359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624087, "uuid": "1b7ea9b1-bcf8-40e3-8f7c-d3c6116ccfeb", "value": "T19FE2081BD94892FDC054C1384F7B753D852976AEA33DF6A7AB88FB213801FB14E19918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624087, "uuid": "6fdb825d-946e-4b52-ae52-07da718ee840", "value": "768:WoVzx7oNMiN9cf9j9bhU5qQcN5A2N362FWEZiy/HfItrmZQ:Ws7WN9c1j9b+5qQcvA2V628EZiyHIta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624087, "uuid": "f4ec5268-aa2d-4044-9dc9-84ac8d2be266", "value": 31568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624087, "uuid": "e024452a-5e74-4de1-aee5-077762fe095c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624087, "uuid": "e80ffab1-f987-47dd-934e-4711ec99b0b0", "value": "fent.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df54457-cedf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764611839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611839, "uuid": "d9ae769f-749d-449f-adc7-52ca8a329340", "comment": "Malware payload (Mirai)", "value": "630ecf1379322b4d39c94655b9760f3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611839, "uuid": "c83ed676-cf89-4dfc-8be1-0eefa1aa71f2", "comment": "Malware payload (Mirai)", "value": "33b0fe07def5f9a4c9c300e94fdf511600f5ba1343180ed2b5f6047a06bd19a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611839, "uuid": "f49d622c-50c0-4557-b1d2-7ac95b360820", "comment": "Malware payload (Mirai)", "value": "bcae103d4ad1e142828267ad8b60da892d8caa0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611839, "uuid": "ab777bdb-ee00-442f-aa02-50d989730d02", "comment": "Malware payload (Mirai)", "value": "827c8fb0b577dd5373cea6fbbbcd6c36a9e08870e9e52a7d10cbb4192b5f3f19cd35cdb8114e98e1c1cddaac8f512447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611839, "uuid": "7606dbee-b5e0-46e8-960a-0cee954535eb", "value": "T1B3D3AD9BB24B1920C46146F40BC38BCD6E6322168E07C9E72E5E593A3D7E6DF19167C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611839, "uuid": "87b04850-2f1e-4008-896a-60de6d7ad495", "value": "3072:XLcufSKtDOHRQ2DNCW1SQEfNzxRgin0q:bcKOSWU11yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764611839, "uuid": "62fdc2d4-e936-431a-8ecc-fafd91221cd3", "value": 132432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764611839, "uuid": "9edaa6cb-73dc-4d59-9848-87649ffdefab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611839, "uuid": "cb44d95c-bec6-4134-bd42-ddaa957848b1", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c6643e-ce5c-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1764555769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555769, "uuid": "cbd67e2e-a4ed-4333-80cc-7ce07788a83b", "comment": "Malware payload (Tofsee)", "value": "7fd08c116cacdec78321cc511b50b17f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555769, "uuid": "48e262b9-6cbb-4f08-80dd-5d4fd9e4279e", "comment": "Malware payload (Tofsee)", "value": "33fdb1d88108e070e964165d1ff0c2ca71625e30795d3af5b7d27d59339720bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555769, "uuid": "a65f1c72-6f27-430d-be76-8fb919eed681", "comment": "Malware payload (Tofsee)", "value": "e83820a789128831726f286bbcb9f4fd7e0b6d22", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764555769, "uuid": "0f36c082-b56d-4cf8-a875-9cb05f0c56bb", "comment": "Malware payload (Tofsee)", "value": "0b5904a1607258bf621b06913b35a39e4a8f8578090776b63b8bf1643cfe1a401a677a4633c651166dfc11b8589bca12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555769, "uuid": "882cbf2a-5747-4ae1-81da-da5ed4d4ff02", "value": "T131F5F123B28A633EF06E5A3749B2D2205D3B7A61A51E8C5796E40C4CCF5E0A01E7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555769, "uuid": "1f674ecf-019d-4cd3-9320-9e35b6f2392f", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555769, "uuid": "1c4eb429-1cb8-48ad-b0c7-77e537c3e258", "value": "49152:XN61T1mWISb4lpzVwUfSTOWoE6gwxmQcoQnQumZObP5eQ9tXDwEwiCZ4TYHx2pmg:XN66rSQsUiO9EkcoxbAPMQvkEwiTy24g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764555769, "uuid": "720cb079-e50a-499c-9baf-a3372708ba3f", "value": 3440272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764555769, "uuid": "2b9354cd-8e21-43dc-aef1-d4a9fd6562a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764555769, "uuid": "e7158cf9-9006-427d-9e92-f0e0520720dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e6ab38-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622957, "uuid": "834de3e3-332d-4b5e-9ce3-b43b37a831b5", "comment": "Malware payload", "value": "27c05bab6efe6d54498a3248d0736983", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622957, "uuid": "1178949b-a39f-4f87-8a65-afeda72a45a2", "comment": "Malware payload", "value": "34ed17fe14acc3ecfcecac30d377886853b9e4d6a3ed51f8e7990e474c686cb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622957, "uuid": "111e1500-608a-4839-8782-125666369cab", "comment": "Malware payload", "value": "a4c8469594dd1a2774a048505e95a001d71d565e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622957, "uuid": "73f89041-3e29-4d9f-95fe-79e60b2316df", "comment": "Malware payload", "value": "73556769c893da06d114cec17793ae3f53f7d5ed03e854d634e3d9c0e569ccec47801f69e41c3a589e8882c4c9f025d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622957, "uuid": "652f5af0-64d3-4905-82f8-e90905b5bbf3", "value": "T1F0946526ED879CA687D3DB93D2E7D61CFEA884DC80175EC1F5B8C6821861D6A0348F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622957, "uuid": "ea955e51-ebe0-48f3-a22c-cb48208ced7c", "value": "12288:Ol204FSrBUL9+W3yA7DU/hGwGZLKEL4U3CP:v8W73CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622957, "uuid": "323cd98f-2d7a-4bab-9900-31b0ca17381b", "value": 418736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622957, "uuid": "b57ba439-14c7-4f9d-83f8-5c5dd592fee3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622957, "uuid": "64f3b5f9-0094-433d-af05-0c67eaa7c8b8", "value": "app_permission.md.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0165fc7d-ce78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764567526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567526, "uuid": "3b2d7795-1b9d-415f-81ea-c6d98c07e1db", "comment": "Malware payload (Mirai)", "value": "012034eec55ea03897f42fe4dca59021", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567526, "uuid": "509e0b06-84ee-44d4-8b26-88e51a8f10b6", "comment": "Malware payload (Mirai)", "value": "35db7c85b200e1b75f91c03e0cfed433867f12dc2049c010b2881f5332ae1bc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567526, "uuid": "fb670c81-1440-4d4c-9c63-c512e457e98e", "comment": "Malware payload (Mirai)", "value": "17989be19ef92058bb556572134cce681ff55de3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567526, "uuid": "d3504fe1-a91e-4937-82af-cd76db6d5250", "comment": "Malware payload (Mirai)", "value": "299525f850a83dc0be999417ea8fa2b1d6399974cdecec495674f9a9ec5947c57ddae32cf88f0c797e8596b655d79e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567526, "uuid": "0cd6d895-960b-4771-9077-4450fd5f48cf", "value": "T187D35C0272180F57D5A35AF0263F1BE083BED5D121F4BA89691F5B5A4A72E3B1482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567526, "uuid": "3cfc955b-85d5-4ee4-90e2-af1360f5af90", "value": "3072:0ZofMw+F7E4JZEacZFtJN4NUocwSEMn9o38M:MoT+EG+FtX4NUoBSEMne38M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567526, "uuid": "13a8985e-963c-4d84-90a8-4aedf9151305", "value": 134024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567526, "uuid": "d48956d5-5938-4473-b5e2-087903e049ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567526, "uuid": "47f23da5-30a1-4deb-8bf5-00269fc2fbb3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3830d155-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764601977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601977, "uuid": "301c8397-1f82-42f7-bc40-1003cf490199", "comment": "Malware payload", "value": "8dae7b1458346c3dca61180f49a00478", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601977, "uuid": "2dd72551-d032-4b05-8049-2e55d2a52aa1", "comment": "Malware payload", "value": "371cdc0f5ce642a6b88413d146fe90d9008b99282b9d04e81abdf416a3f3ae7e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601977, "uuid": "071fe890-5ba0-416a-ac08-f5c9a9cb7ff0", "comment": "Malware payload", "value": "e9bc61197231a3d18ac6cdcc24c6970b076a7f22", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601977, "uuid": "6fd87c2b-03c8-490b-b3f1-1227689c830f", "comment": "Malware payload", "value": "fc04d19c3978a1b700071432f53fe0062ea0043bd363bc42f299c7b87d3d9ee822a626ea36d7a8c5af0f8f837199d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601977, "uuid": "fa01066d-4a00-446a-b499-c17be120b2ec", "value": "T1BFC3D06DB64D9F03CBDC0B76804749E800A3F1F6C591EF5B9DE52E910F02BCAAC99919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601977, "uuid": "fcdda3d5-a395-4178-974f-491293bff228", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601977, "uuid": "2ad4e9a3-218b-4b39-88ad-f15678b5a2fa", "value": "3072:Kp7RNQ/4KRN+FLyBReNWK6mLhCxwOT2/TS0p+Mi76P0k:KFHi4+EGbe8K6mIxnT8Tz+lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601977, "uuid": "a64381f7-cebd-4431-8450-f96db321aab8", "value": 127112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601977, "uuid": "334156f5-033d-4661-b732-7ab842fd5315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601977, "uuid": "da934f1c-f8f0-443d-89e1-39e7ce44713e", "value": "2.4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e23f90-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764608329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608329, "uuid": "a3b66caa-1ec6-41e5-ae84-94037f5813bf", "comment": "Malware payload (AgentTesla)", "value": "b82249745dfdeffde9bea75e17c74289", "object_relation": "md5", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608329, "uuid": "34257132-e3bd-4ef4-b45c-9515ecb6a4db", "comment": "Malware payload (AgentTesla)", "value": "376365bd19592ce5564fbf9508ed76d0444efc7b6f0c545292f3075b3f10915c", "object_relation": "sha256", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608329, "uuid": "4e5fb4fb-3899-4dd7-9bb0-3ec02ce0b352", "comment": "Malware payload (AgentTesla)", "value": "c9b3595ae430e781f16054edb89d1f9fcacb18b9", "object_relation": "sha1", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608329, "uuid": "4cc96204-3626-4287-8d8a-b2ce15888c7d", "comment": "Malware payload (AgentTesla)", "value": "ccf2adbc58a26945d338f20976020204c23533f175602bbd7b9a54a4f3c0bad761636ffffc5eb00e7d45507979486f7d", "object_relation": "sha3-384", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608329, "uuid": "0049cf0e-f75b-49eb-ab40-9550b59267a2", "value": "T12D34FE037E88EB15E1A93D3782EF6C2413B2B4C71633C60B6F49AF6518516825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608329, "uuid": "808158fa-5878-4b52-b387-e9d238834309", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608329, "uuid": "6dac5457-64a5-4a0e-b6f9-fbe26d03f93b", "value": "3072:hRpVplR1l6g1NAcbvVudhBEe5TyCSYqS:hRpVplR1l6g1NPbvwSVCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608329, "uuid": "1c6e891a-77bf-4712-89e5-a5ba55589c32", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608329, "uuid": "75f2f9d1-1989-4b52-ad11-93edfa2343a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608329, "uuid": "d0c88a78-affc-467b-b84e-414903f67644", "value": "e8ae4cc3-dac5-429a-ad46-d51bb0595a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf79385e-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621559, "uuid": "a8f36faf-9e36-40a0-b6bd-f02452a6a8ef", "comment": "Malware payload (Gafgyt)", "value": "c764da5661381532be585c698a43a582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621559, "uuid": "11bbfa8d-fad0-4c64-9410-5f910d02e6d4", "comment": "Malware payload (Gafgyt)", "value": "38f6fa209d541ad3e042ee21d5160d51c517e983987fcdf9b8c8654fc0031618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621559, "uuid": "57c1f9eb-1c86-4cb8-8c9e-1fd596cf49dd", "comment": "Malware payload (Gafgyt)", "value": "61a2feac29bf45845a2c7c7ab8c06bd6cbb201dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621559, "uuid": "50a73fcb-344b-4298-895b-fbd3f71ec6fb", "comment": "Malware payload (Gafgyt)", "value": "c6e26f379a7561e25411c312f07e16e3e3136519fdf468a7168901dfdb48cd445701127bc856a015f19b3850730d0ed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621559, "uuid": "ac213a7b-b73a-4ef6-a64c-0554fc3267b8", "value": "T157C32BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621559, "uuid": "921be4c2-f5e0-4c62-ae77-978b8fff458c", "value": "3072:SNhAfn3U8UXULUwUbUJ1hYlHRRDsBOnRZ5hgkEemJC0OzQaGyPZk:SMf3ts05gehYlxO4RZ5hgEmJC0OzQaGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621559, "uuid": "4c5ba2f2-0ebb-41fa-b941-deee796ea1b8", "value": 123364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621559, "uuid": "17757ef4-49d3-430b-a142-bec954b1ba5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621559, "uuid": "7ffbaa94-59e2-4e87-87d3-4542713f96bf", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff386b1f-ceb4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764593721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593721, "uuid": "a3d38fd8-a1b6-4d8b-918e-7a1c1789b742", "comment": "Malware payload (Mirai)", "value": "3b9dd71acdcacf92a20a6d0d093c28ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593721, "uuid": "7854a1d4-a810-4708-bd65-4ce45e4bf2f9", "comment": "Malware payload (Mirai)", "value": "3933eba9b69193538a4b2cc6614d498646e75a55d20e7cf4f9de056976a6ef5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593721, "uuid": "13c4b462-61e2-4998-8914-c0f931a9cc9e", "comment": "Malware payload (Mirai)", "value": "efca35e9a4c1f097892481fa4be39b4be4368f4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593721, "uuid": "f3813cb7-c2a5-4171-909c-c46738e473dc", "comment": "Malware payload (Mirai)", "value": "3408ec80c486d59f5b26d6e109d43c19aaf2ca6188096edae7c4f51f07412efd95438915e4ba5965587074340dab1d3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593721, "uuid": "37075dcf-7f44-4064-b63b-5d25503bb50b", "value": "T1BBA3BF32C82A5D98C18505B8B4E6DE365B23E5C417932EF71AE6C7A65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593721, "uuid": "b3ba0e74-448e-4998-894e-9506bfa9d934", "value": "1536:H/I9A0n3bQK05LKGVwS0gYqcKDFVut7DAQmHICwE6SPXc/:Hw9AkrqLK/gfDDwAQmHIEvvc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764593721, "uuid": "da1cde48-c563-4cd3-80ab-d2960f2179ec", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764593721, "uuid": "c5060f14-316e-4607-a82f-b91e183bd128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593721, "uuid": "4cbce83f-517f-418d-9a1e-30f31e299d47", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02734dc2-ce71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764564521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564521, "uuid": "cff891d7-4fc9-4dc0-b946-ee6f2b44292b", "comment": "Malware payload (Mirai)", "value": "dd318024232f86bfcd0e2385acf3fe23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564521, "uuid": "abc773cb-da63-4459-91c0-99b8f63bc39f", "comment": "Malware payload (Mirai)", "value": "39b894fa6c17506aa51cdd096267c00827ef5a746e66c294f48c31b0fe68c303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564521, "uuid": "f55f781a-50db-43a6-811b-977cb5952ab3", "comment": "Malware payload (Mirai)", "value": "8c9d75db35c838df2c0641ce9c362ba9cfc12ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564521, "uuid": "31ef8fc4-b1d8-437b-9085-1520781ec030", "comment": "Malware payload (Mirai)", "value": "95d89df928f00ed086e532022ddd937a9f6baba65d158357f095aee6e153a3e296e94175c357627d6283eabc2871b567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564521, "uuid": "b02a45fb-7abc-4f2c-a1f1-38e780a76585", "value": "T160A31906B9819F11D4D621BAFBAE414933136FBCE3FA7101DD20AF6427CA9DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564521, "uuid": "4ddab59f-7bb1-44bc-92ca-a031dcf91270", "value": "3072:bDrgNCkk2pNaezbEeeZvTSmM2sulQ5Kb:bDrpNINaezbEee9TU2tlQ5Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764564521, "uuid": "ecb2dd62-45f8-476f-b8db-b90c79fb88de", "value": 101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764564521, "uuid": "0f77d0e8-a38e-4217-9421-d57c186e5091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564521, "uuid": "9c2afa05-50fd-4218-9c30-42a2f6fe6d1a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2886a160-ced2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764606246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606246, "uuid": "f40c1184-c21f-456c-932e-c06e99c95228", "comment": "Malware payload (Mirai)", "value": "9e33a3cf38d4e01f42ddff4efdf10f45", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606246, "uuid": "57606653-b4ac-44f5-ad4a-00c5b61b72a0", "comment": "Malware payload (Mirai)", "value": "39e3346deebe6f052ccd48e1a2418b1634b26ca000ef1c22bab5825311489940", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606246, "uuid": "f93b9703-0a07-48b4-abd5-c0ff825e203b", "comment": "Malware payload (Mirai)", "value": "becd361d7c7eebdfee6d5b6473ba374884c105ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606246, "uuid": "79f3d9a6-cbb7-434b-8355-3e8cf61eaec8", "comment": "Malware payload (Mirai)", "value": "5aee1637c7ddd1afedfd1052c56f3279cde7a3a3a6f131d0179a55f7546c5f4e12dd0322cec52795a983933278f8d95b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606246, "uuid": "a9a0d5ce-56f8-4c72-8336-4c22405a0392", "value": "T1AE118FCEB2A125320C81CD7461618E2C943499D535B28F5E9DEC39FAD2D6D24B327EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606246, "uuid": "a0f8ffc9-3500-4502-8947-00119db44987", "value": "12:I3YE1NIl5I0LKmP+ObhjM1T5NSOTtjN2bR:MYE1NI77KK+4jaTrlTtjNOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764606246, "uuid": "a980d474-ddac-4ee7-b292-d645693f30e7", "value": 931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764606246, "uuid": "f1b559d0-4b27-4c2e-844f-34c907776dba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606246, "uuid": "90110576-72fd-4a5f-bcee-f27ae2e8781b", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbd4f65-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621554, "uuid": "19fadd7f-e4b4-44f5-a705-245ee3e9d096", "comment": "Malware payload (Gafgyt)", "value": "6fc85228ad99eb33529f16146b036165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621554, "uuid": "4c3a2943-58b9-4834-aa0a-48243bfe5dfe", "comment": "Malware payload (Gafgyt)", "value": "39f44253e84a39555f31886967b5c864a288bcd8b79a2ca2428d72dd4af3e20a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621554, "uuid": "450ee2a0-72ac-40d2-a80c-72d1712608fc", "comment": "Malware payload (Gafgyt)", "value": "0c99cc399bd760805a59dc93d1d4a7c19ba36736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621554, "uuid": "5656a52f-518d-41e2-8cbd-29fe0874550f", "comment": "Malware payload (Gafgyt)", "value": "e5f92959b13dd2b3ad1b0f8b8da446dc25714e4d75fa316e0bdfdf6090bd043231639a36ae0ad666adb9caf37244e3e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621554, "uuid": "832f1b6c-1375-462a-af44-7737ffd7a32b", "value": "T1B7D30A77B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621554, "uuid": "384857ca-d83a-4a53-85de-9c18ebba828e", "value": "3072:eVrQyEDCvqBvpnTy3D5hgrJ3JCI0Dmzj0qDJAGyoze:eVrQyEOvqbnT8D5hg6I0Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621554, "uuid": "91e90aee-d098-4abd-ab39-8e79f9b79e41", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621554, "uuid": "a2aec413-1c16-4687-a3ca-3cdaf72a8d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621554, "uuid": "27f51962-ad99-4af1-b7fe-739c42828bee", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2010a5dc-cead-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764590341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590341, "uuid": "8cc03869-f102-43e7-90db-29b1f988a49f", "comment": "Malware payload (Mirai)", "value": "38c8148d2ea8bb54176350ccddbee1d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590341, "uuid": "a7149325-006f-4bd9-8843-578b139db7ba", "comment": "Malware payload (Mirai)", "value": "3a0c773b80159db694afa29833a9d018976082a1eb3fd0c7b03479456b27beab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590341, "uuid": "1b9895ff-3c7a-4c32-8f92-2dc264ac1c72", "comment": "Malware payload (Mirai)", "value": "de344a80f8222466dd128fccc2e0a78b0da583bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590341, "uuid": "d2941f97-82a4-4551-98b8-2bb36c9c6a5d", "comment": "Malware payload (Mirai)", "value": "1474737858e737d1fb323982a306fd18e0c1844f32a8025949ea393246138cb8e96c6a1986211f6e6fc355d0fb7067b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590341, "uuid": "4d27028a-93bc-4f39-9c47-b63872a0eb34", "value": "T11D041955FD816F00C5E127BBFB5F424933672769E2EEB511DF104F2223EAA5A0F2A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590341, "uuid": "fee890fd-b72b-4f74-9d8e-542fe549fa7c", "value": "3072:iaB8o0HD2/fIImwNiOhw591jhg6+/Fso58zPjh1f/wO5Q9rabZ86ij5irMw/Xn7e:T/YVOiOhw591w/Mrjhd/w0qrabZ86iFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590341, "uuid": "f879af10-b5e6-4e42-b839-f53ac50d4eed", "value": 186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590341, "uuid": "93fc6803-cfec-4035-a3b5-f58e5a3042d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590341, "uuid": "bcdd17f5-fe3f-4d8e-908c-5ec991d89694", "value": "lava.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa17fac-cee4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764614142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614142, "uuid": "846933c6-144a-4131-b875-3dbc523769a9", "comment": "Malware payload (Mirai)", "value": "ec88e6730252586cc0e06a0de905479e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614142, "uuid": "1283de33-072d-46ec-ae15-cc7ddd49ceec", "comment": "Malware payload (Mirai)", "value": "3a669e4cd47445902a7efe698bb215d55bfaefc1c570e9044865e3470b312fc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614142, "uuid": "abe3e4c0-c64d-44b0-a1c8-4604e24f414f", "comment": "Malware payload (Mirai)", "value": "d5cf97f4c0c883e67925003cfabced577e8b1ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614142, "uuid": "a1a5970c-4589-432c-ac10-0df4eb42b5d0", "comment": "Malware payload (Mirai)", "value": "80f8c5eb8a52fc7ad8ba817de755408c937253f4bc669a3042edd2a5155a246dc572d1f9f5a788160d3dc369635a9c0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614142, "uuid": "ace2a6d0-f19e-4947-afb3-00203adedbd0", "value": "T13FC3F559F8819B21D5D615BEFA4F529D33231BACE3EE7203DD145B2437CA91B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614142, "uuid": "c44300d7-fc46-4000-9c5a-436a24b5bfcd", "value": "3072:Rr03BtcD5TuoNLdZkVxJddmIHFVZBagUmuN0XapJIGw4Ll5gxsSDYlI0n5Q:l03Bt65qoNLdZk3JddHH7agFu6XapJIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764614142, "uuid": "6e3613c4-8806-47db-a58d-80cb9ab54322", "value": 127216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764614142, "uuid": "a796f78c-3ecc-4825-81c1-c28883e2836d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614142, "uuid": "395dfdd1-dd13-4c62-acc2-409b2dfc76aa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69f4102-ceb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764594942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594942, "uuid": "71261052-320f-4dac-aab1-02718f5fcff2", "comment": "Malware payload (Mirai)", "value": "307f7a74dd41e00b3257a3392601c85b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594942, "uuid": "7a6bef3e-378b-476c-84f0-d167edc1cd37", "comment": "Malware payload (Mirai)", "value": "3af96efb9a0d604f27c2dd5708d48523c1ce52c8c5cd5fb32e8d9c754895b1fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594942, "uuid": "bb59e06b-cca1-4275-9a52-8a82def99de8", "comment": "Malware payload (Mirai)", "value": "2934dd612a1ea5782bc7dd07289e9e915cadab5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594942, "uuid": "bf1ba3e7-bb3b-4620-8e32-260a2599f91a", "comment": "Malware payload (Mirai)", "value": "0f7ab7aa142e308a370fe84a2223304af79e68e9bc8e9743e2f5d112e944e56ac2038846fd9e033dfa5cd224dc440069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594942, "uuid": "981e52a2-c226-4acc-a1b8-b1242dea49e7", "value": "T1C9A31896BC419F22C6D056BAFE1E528D33231FB8E2DE32139D156F2027DB91E0E7A451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594942, "uuid": "990cd1dd-f55c-472b-9fd2-3fd0573c151b", "value": "3072:2WSka8CAtn6BzfqLrsy5ax3DzUBI+MaxZEo14O:xSkXtazfqLrsAMzQBRMax14O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594942, "uuid": "0a9a54cf-f12e-46ae-a082-c8b7eb37ce8c", "value": 99016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594942, "uuid": "41969f37-de7f-43f6-8f2a-4bdf71d7a023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594942, "uuid": "b6304e0b-f2d1-4a34-beaa-de993e2ceb07", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77ce207-ceb5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764594138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594138, "uuid": "8b2b1657-173e-434a-baa8-d1fae96d4439", "comment": "Malware payload", "value": "b8df2243edffb95db3299d068d54724a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594138, "uuid": "aa163544-7e8f-43b2-b9fb-91b2c4e6e71d", "comment": "Malware payload", "value": "3b564199cb0c34fcdc8e990328ca4697d5e1273af40ffae6a7ba7aef12b4d72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594138, "uuid": "767d8d54-17e0-4fcf-8d9c-0d356a247f64", "comment": "Malware payload", "value": "aa6be2fa5f0e780f98916efbabc0bf9d257fc9ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594138, "uuid": "96055639-7f05-49d9-b7d9-56095e586db0", "comment": "Malware payload", "value": "f58d8be5d7b82b10c20611b40d91481050975d59896270a42e6c0386bfad332d07d281b7c331a466607978163f1d56b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594138, "uuid": "74703fde-a169-42fe-8263-694b1b195c2c", "value": "T170C60893259B5CF6DEC637B875C762396B34FD26CD581B6BA248C024AC833847D2EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594138, "uuid": "d186d38d-72c5-4478-9be4-731be69fe35b", "value": "7dbf86cd5334efbcb350a91571e24397", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594138, "uuid": "6f5ea8c6-e073-4d0a-85c5-c55f112f38ba", "value": "98304:QsomcVw8ERMk4ktEEKgYs4y9dpj6tqWL7zhOBykb9miieIaH8CO5d9u405Y+o3Qy:Qs/cVwaktEOYsPOR0XHs1c+oU3fntj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594138, "uuid": "7dbd5060-82f6-492b-8cd5-2d51e845beb1", "value": 12499019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594138, "uuid": "f0f99486-caef-4580-9561-c11c5453f7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594138, "uuid": "8d4fd64f-96aa-4a52-b9fa-d828a4529467", "value": "olympiad.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3450edef-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623016, "uuid": "49957581-91b0-4e9f-94a0-ce05154be465", "comment": "Malware payload", "value": "e68d2489827c4dad1b62c9b64b89aed9", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623016, "uuid": "516e81df-95a4-4bc4-98d7-55d365f2be0f", "comment": "Malware payload", "value": "3c3892d90e6e941d1c84e4e0ee2ca56ebe1314699257cdce890821f351fb9c65", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623016, "uuid": "7d2d76d6-9370-449d-826e-4208b4985cc9", "comment": "Malware payload", "value": "531dd2cbc614b492851ab65be19324e60e9f2901", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623016, "uuid": "c1d89e08-658b-4f02-b1b4-b9f46863aadb", "comment": "Malware payload", "value": "4679c867ec70b39b8b819b4c67c8380a24acb4987c07aaf4e44a41211896ca8c46fd9557337e81c3e5e309f1970e65c5", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623016, "uuid": "a3a81ca7-0a01-4217-bbf9-15cd7f4cf077", "value": "T12F947426AD8B5CA7C3D3DFA3D1E3D20CBEA844ED910B5EC4B5B8C2825461D2A1749F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623016, "uuid": "9f5c8d58-caf5-4c8b-826f-6884750b04e0", "value": "3072:kD4Vd5f5RU9ksicBStI2yVhEJG25C8E6Tc:kD4VTf5QksiZtI2yViJI8En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623016, "uuid": "8165efcd-a447-4b72-92dd-dfb681e194f9", "value": 437230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623016, "uuid": "257af828-63b0-456f-8570-6b1a290f756b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623016, "uuid": "4bfe6ae7-14db-4d2b-ac0c-9af3a147d21b", "value": "crashreporter.md.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b016bd89-ce83-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764572543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572543, "uuid": "8c4dccd8-e3c9-4637-82b0-f1968531c0e2", "comment": "Malware payload (Loki)", "value": "17cb8d802872f8c015bc8ce02069fba0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572543, "uuid": "0b10a867-b439-4f22-be6e-c73059d743f7", "comment": "Malware payload (Loki)", "value": "3d59b28ef69143962b9b65687d9cdc2aacdd0e8f041b4f60662ea5349a7ae3d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572543, "uuid": "5afcd9bd-008f-468b-8ec1-af47e5f5258c", "comment": "Malware payload (Loki)", "value": "3c8c58001c9766816bff27df37ebf181a6455f53", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572543, "uuid": "3f58551c-8013-4511-8e11-4591be40a0e0", "comment": "Malware payload (Loki)", "value": "98add10d860dbc4423a8d86ed16d6656a70ad6e3be0bddf6b2613c30a1339704e6006a099b5041eb6312f789b43e60a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572543, "uuid": "11a79856-c5c1-40ff-b679-408ce523b8e3", "value": "T14DD3D07574A5E816E161C5300DE7CABAF72EBC446CD6420727133B1E7D3A6F88B22B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572543, "uuid": "4b083f70-4140-4662-b185-82f1f5d3b12f", "value": "1536:yZnSJw/pTzPW825yNcd5KSywwFm9srGZUjUEPGyY8Olr+JLtiVNklIycn91BxksZ:yH/pTzyqtdQ2YJlAZiV8Tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572543, "uuid": "efc1b8ba-04a2-42c5-b0d6-3d2739e99b1c", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572543, "uuid": "813b7fb8-039e-4ee2-b8a4-58c7b332d5df", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572543, "uuid": "9b4aed38-f543-42e3-b6ec-1d4a52fcaea4", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990a9a97-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764598275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598275, "uuid": "e9e33663-9b3d-4529-b745-012393ada76d", "comment": "Malware payload (Formbook)", "value": "420e842d0e54e719e87097277640a95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598275, "uuid": "847f6d0d-efdd-4d45-ba84-ae66e42bc454", "comment": "Malware payload (Formbook)", "value": "3dd4e4abfaddb0fa7756579f0b50e3905ed32ad871a8a7db4cd841ed8576ae2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598275, "uuid": "4a119e4b-a148-42d7-a8a6-76bdc60e607c", "comment": "Malware payload (Formbook)", "value": "14a94dbb61a89e2a9fa99a6f549890e7cf2fcf76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598275, "uuid": "67bbf9f0-88f0-46a7-a923-491c1a0b401e", "comment": "Malware payload (Formbook)", "value": "6fee87bfc8b83f16d3c61fe7142fe480fe6e5b588edc0dd1a7120dd31b078f34a65204b360889bbe60cb8b8e3a90cee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598275, "uuid": "8af4bdf9-2b4a-4afe-a79b-563399542642", "value": "T1A446AAF45DB26B10F696C3CA7056F9C4A92B38126CE6CEC8F77EDCA414E5C20F94560A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598275, "uuid": "45aa6e20-12a0-4e9b-b39e-2ef7d585136e", "value": "24576:15DnyOOCzV7Iplm0lTkrP6LduQ5dNGxopNHgzAlTh1n4Jr9:ZzV7Iplm0lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598275, "uuid": "426204c5-4ec2-483c-a5c4-b1453e34c381", "value": 5487794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598275, "uuid": "5d1ff6a4-272f-4eaf-9c76-aa08661e6b6b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598275, "uuid": "8b33a73e-00e1-4742-bfc8-068de5d234d3", "value": "Bilitie.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7510189-ce9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764582890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582890, "uuid": "c04494ba-dc43-4fa1-aaf5-6b17f8e72f6f", "comment": "Malware payload (Mirai)", "value": "9a0a444f9705c928e5144c810f0a2a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582890, "uuid": "e15d09cb-64f5-486e-af69-82a48dfa781d", "comment": "Malware payload (Mirai)", "value": "3e758d8e3e456fb3cd439f89a180923eb69fb0b5bd470cbf4ba789ad318d2455", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582890, "uuid": "d11cef44-473c-4bd4-8fb3-5d38296b868f", "comment": "Malware payload (Mirai)", "value": "18aabc1d587c0b4d6d5153f414b07a353e7f1478", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582890, "uuid": "4352a119-8034-4f2e-96d3-bb8fc73e5db4", "comment": "Malware payload (Mirai)", "value": "666893a816b175597ff560d176bbe01b9bc1bf7d97df75c00bafe0735687a4ab5f3260f6ce05757a4f0da9708d877518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582890, "uuid": "2ba861d8-20ab-40e8-b73a-e1a1590a81df", "value": "T103530207B038A813EE32F57D42E5B74462D9954C5DE8DB4ABBC3CB44A7731676368C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582890, "uuid": "1d1a572d-b5fe-45ea-97ad-2bd9e099d7ac", "value": "1536:P9QfFHS7/EcEPHHYpJEKybf+y7S3ycUT1aq80Q4wN0DLqMsSt:PufFy7sFYrE317ZaZ34G6Lht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764582890, "uuid": "f543cadb-c448-400d-add7-80b9491d39ae", "value": 61380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764582890, "uuid": "c456892f-b0d4-4f0a-a89a-3178a6980400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582890, "uuid": "1408fb3d-8f69-4479-a7b8-be7589a500c3", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5320bcd8-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568951, "uuid": "9adb7f8c-6af6-4824-a657-5107ab21f83f", "comment": "Malware payload (Mirai)", "value": "928f956aee073945e6fc32e30d9df658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568951, "uuid": "a952fee8-781c-4579-acb7-d2c82d692132", "comment": "Malware payload (Mirai)", "value": "3e7e8ada7eb81fd102667a6f99923f8a5f856743cbfd25ed7dfd2c2fa1658b18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568951, "uuid": "dddffe29-1f45-440b-8926-e898b1dacf87", "comment": "Malware payload (Mirai)", "value": "8462d01a9bbaf9d05a75212a4901aaea567f2988", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568951, "uuid": "0fa4b397-9134-40f0-9a85-2d6567eb8ec9", "comment": "Malware payload (Mirai)", "value": "0921dbcbd07caff6f8d1e7323a332d34eb5cdf369e0b32835e096f990d7526c17563ea6361d45c16f04f0683f8088e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568951, "uuid": "1e2b47f2-c649-494b-a3e3-b700aebbca25", "value": "T156C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568951, "uuid": "0142cb7b-9080-4a43-b4a2-febb3a4e6567", "value": "3072:HDWrFoeatGA59EqP98nTma9uk4cIXEuNGtr:HDWJoztGA5Om98niat4XEZtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568951, "uuid": "fa8bc7ae-fb31-4281-ab1b-10ef7d27a0eb", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568951, "uuid": "3b17c8b3-70cb-4ecd-9bdf-7b4ef5de29a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568951, "uuid": "db6e826a-1aab-49fd-bae6-efb85cc2d21a", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8056a9-cec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764598525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598525, "uuid": "6eacc078-95ed-46e2-a18f-d4c8b0337c9c", "comment": "Malware payload", "value": "0567a73af185817cca09cf8ea4924592", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598525, "uuid": "670bb643-1ded-4af6-a53c-bad21d83d478", "comment": "Malware payload", "value": "3f5cfe942366325004bdb007fdff52e43780dc3bc7d40145ef9493e912ed3cdc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598525, "uuid": "2e9e4b2a-76c0-4708-97c1-996becdd8329", "comment": "Malware payload", "value": "e6804cbae29a23b5f3b9812b87922acb5051d4bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598525, "uuid": "ee026b50-387f-4f5b-8e06-68d7f9f77b79", "comment": "Malware payload", "value": "26536d20288ec24c9ada0d0ccf1668ea7e6e5cbd1830eb6bd3eeb1fbe53a10880b8ecdf322d72862765a03edf948eaea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598525, "uuid": "5e9fdff3-6336-4ede-9552-6479a68af936", "value": "T13EB01284802D00430C24BB0424602CA0300852F064C04E3CF0AC4C71444C511BCC0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598525, "uuid": "c8027a20-11b2-402a-b649-06be5d5634ff", "value": "3:TKH4vGBwkSDk3LWEXK5LRhdp1ZKW6Gw9:hBDCeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598525, "uuid": "79638ce6-1ff9-48b1-a4c5-315787e82646", "value": 94, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598525, "uuid": "57fd244c-26cd-488a-b9f9-0624a57953ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598525, "uuid": "4fe4b266-f4b3-40b2-a429-42347549eff7", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d138fb7-cec7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764601556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601556, "uuid": "6cd2c555-bf09-4b47-88f3-6f7d58450cea", "comment": "Malware payload (AgentTesla)", "value": "c23779a451a6b2be091e4305332f5c6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601556, "uuid": "0c3b4589-386c-4ff7-8846-b0556fffdd64", "comment": "Malware payload (AgentTesla)", "value": "3fcfea23ca2e49340c4404c5273a61be1d42d94b90419ee4eb20eb12472fa6b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601556, "uuid": "a647c142-dce6-41bf-82c1-f6494f477539", "comment": "Malware payload (AgentTesla)", "value": "524685c4baeffee2bae5bb3ebe19e1e8bce0e9a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601556, "uuid": "ce8dcbb7-96d9-48d5-9ebd-7cfeca48ad6f", "comment": "Malware payload (AgentTesla)", "value": "f60af663951b636952320be6e25b8c6511562384e350f6615d8928e15ebe6684dd92c4e5e785de8cc588cc0685724a2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601556, "uuid": "069655d6-6f0c-4bc0-9e67-be26c4cc87ba", "value": "T1353533A7D84E6E5CFC2331FDC98674F1026CDCAE2096E70855579440A702BEE14A5BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601556, "uuid": "a39c35c5-7045-4a7a-a7f0-8251cdd01706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601556, "uuid": "4a38f9dd-984a-4a51-afaa-42e57372c977", "value": "24576:eOmSW+09Fl1kt4M5k3DpimE4hPYOVXdBN6r8A/gBMCR:ew09nak3DvXVXXO2MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601556, "uuid": "b398a8bb-a36c-4e3b-8833-299271d669dc", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601556, "uuid": "647f1191-346f-48c6-bbef-b9c287d560c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601556, "uuid": "4a9cd97e-7d3b-4b16-b3f3-b708129d0c8f", "value": "5106784200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c7eae4-cefe-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764625295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625295, "uuid": "46fa5397-238b-422d-8d93-84ae905f599a", "comment": "Malware payload (OffLoader)", "value": "31c60946ccba73a9744543f9120dd9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625295, "uuid": "b553decb-8405-4ef6-add2-4ff35e0bbca2", "comment": "Malware payload (OffLoader)", "value": "3fe1d9393cccefd8f83a40fc4522bc3e99831eb175c5bd2618a11ea28511b3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625295, "uuid": "54126901-7097-4e35-9362-710d5dfa3846", "comment": "Malware payload (OffLoader)", "value": "5d6593e3efad0354c160f17a465c965e24a2c985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625295, "uuid": "fabbf6a2-ba90-42e8-9dab-22eaa13b8e38", "comment": "Malware payload (OffLoader)", "value": "163ae68013369dfa5559633c1894c2facce3bff3e7bc27c886a0f70fa3c3bc76f2440dd7c6cbdf4e7ba6c4c7900f882d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625295, "uuid": "c8d8bab2-dfbf-42b5-909b-fbeed77dfb7f", "value": "T137160123B34A673DF46E4A3B59B2D230593B7E21A80E8CD697E44C4CCF294601E7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625295, "uuid": "eb31b182-f7de-4a2f-9d88-f851adf8d76d", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625295, "uuid": "6413f50b-5f63-4593-aa12-83f3e7bcd8f4", "value": "49152:EN61T1mptmTM/cyM/QLzkHeIz2t7Ml++kzSL9sJYeX1nHPKxl1b8JmdGW3TpO:EN66psb/Scnz2MY5JYQnyxl1ddGSTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764625295, "uuid": "851899c1-a314-47cd-aed1-adef043a71a2", "value": 4210987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764625295, "uuid": "6319c6d9-a5bc-451c-88c1-b3856b54aef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625295, "uuid": "6c96ca66-032a-4880-91e8-227d16be66e0", "value": "vlpafdf_325as3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabd802f-cf0a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764630651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630651, "uuid": "d2725a33-f68c-4b0c-a86d-9807699354cc", "comment": "Malware payload (Mirai)", "value": "d9c5b592b94931a5b9de54461b22b2a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630651, "uuid": "77787a78-984d-417e-810d-e5c859ad8184", "comment": "Malware payload (Mirai)", "value": "3ff974e4a12adf51de78b99a404a01a449612d5692336319eb4aa80bea5488a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630651, "uuid": "f83e38fe-d2a1-4c22-b850-0e42b11e2b70", "comment": "Malware payload (Mirai)", "value": "893d0f5ddb2ec533e85d6d5b39472ade39f3f1b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630651, "uuid": "f42d0402-4756-4348-91f8-130c33576fe5", "comment": "Malware payload (Mirai)", "value": "42574a0f62113411f142ceb321521628d252043053783faa899f5d0bfe1250fc2a977a369eea5a62585c7f2c233ee826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630651, "uuid": "2c0ca529-8fa2-46e4-aa79-94ce52fdaf23", "value": "T163B32A81AC818A25C9D516BFF92E018E3323577CE3DF72229D246F2537CA92B0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630651, "uuid": "2f84f78d-2c61-44ea-88e4-1d4e270202e1", "value": "1536:20nsMb6GkHDmI6u0d7SwcMTDqc16r1qBZaE5eW95ZXTTa46y7oV8McivowKQNBnU:u1dr+DbQrkndJHTTah6JQNBn3uvOl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630651, "uuid": "36fb9d68-886b-4da2-94d5-9ac2b8a7cd2f", "value": 109072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630651, "uuid": "38fef07f-e6c1-445e-b7b5-b7d60817392a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630651, "uuid": "becdf97a-f7c3-417e-b2d1-3040a7da137d", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5edd56-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764598148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598148, "uuid": "53d238e6-2d01-4f05-b56f-fffc8b1d13f7", "comment": "Malware payload (a310Logger)", "value": "27a0d7a58c1d4dfabbc600ac8aa1de8d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598148, "uuid": "adfcd93a-1fe6-4aba-b3b7-a6a353eea017", "comment": "Malware payload (a310Logger)", "value": "41a7ea4325b76d7cf721b86c2cf60ccb0ee2b9773be7ba8aa2763ebf18335805", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598148, "uuid": "fc9523d7-0537-464c-ab05-70c0dd92c9ae", "comment": "Malware payload (a310Logger)", "value": "92a6cc38485b2e840cbeef546228d89df4b13c8b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598148, "uuid": "79e3e377-b133-48df-9167-1490f17cf37f", "comment": "Malware payload (a310Logger)", "value": "52dcd1344901fb31d8352a3d700cbeb1bb9c1faff0fa16f22f4140be0dd5c48a320daa3152a6294f566752cb4ed4b9e1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598148, "uuid": "e2953bf1-7acb-42e3-a27b-4c45c91b1752", "value": "T12F45E0053745DF14C51F55B2C8A3C2F8532B7E40DD009BDB76D9FE2A78B22EA6A62087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598148, "uuid": "a4a0fb2c-fa58-47cc-b30e-7585b0cdd492", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598148, "uuid": "6d9dd8f3-9306-461b-9d4f-80ba93f47249", "value": "24576:Df+iN57Gtene3Hr/01S+jKDl+Pgn87DLMVqFIYPMk:7LXKtene3LMtYl+Pgn87DLM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598148, "uuid": "1eee11ea-3b60-407a-b673-23cf45dacf8e", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598148, "uuid": "f5d77f6a-85e2-4662-b526-de6dc0056116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598148, "uuid": "6572a48c-a8ab-41fd-bd33-6521920a877b", "value": "OOLU2566777430000739829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212230dd-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621266, "uuid": "1b98e3dd-9f56-462d-b632-12128f3bf2dd", "comment": "Malware payload", "value": "d1bf9ef671c07fcbcec0bcac0d7653b7", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621266, "uuid": "1d9f64e2-e9ed-4791-8bf0-c3e4d10971aa", "comment": "Malware payload", "value": "41dbf613dcee7a04f45b051dcf493571469b00ab9db0c9305350505fb535e7e5", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621266, "uuid": "c6d3fa15-ede7-445c-8fd1-78d9a826001b", "comment": "Malware payload", "value": "eb64b8a357f419e97ca1c0c04c94f4bffaa6fa8b", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621266, "uuid": "c281f9d8-7df0-47d0-b5a3-8c9d41fe624b", "comment": "Malware payload", "value": "00805145018427c5f2a6178eb47482a98ead91f04d4e9e455d328eb48a8654ee2de9bbc06047b16d38c60949a57bae13", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621266, "uuid": "5b0f383f-b992-490e-aff8-b91ecc4587c8", "value": "T13272D02FDCAC340DFEC58AF189F5AF97507388A4547876A1019CE50781D1E41FED92D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621266, "uuid": "174b9d09-5cf1-4d44-a77c-ef35f4b84d0f", "value": "384:n50sc0NNwy+YtwKLlx02UZRMrGWrB6U/D2JXE/Er:n1rDtzRwHWr8UCx0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621266, "uuid": "06a3f843-e326-41ea-bf33-0a189d164048", "value": 17180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621266, "uuid": "14a7432e-ae1a-4520-9402-5818388f6b9d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621266, "uuid": "0e99e7b9-9fc8-4842-b224-1e231b0f1ae4", "value": "file.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c7b3de-ce73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565762, "uuid": "ad3c0345-d134-4558-95e8-9cddfbe5e334", "comment": "Malware payload (Mirai)", "value": "3b3940dd199b614369cfd5a7fde590f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565762, "uuid": "610e1b13-3d6f-44d2-abf2-f16906065a13", "comment": "Malware payload (Mirai)", "value": "421392caf59e71ed4c0fae0a399fa1b0babf7476caf38ff90e71076e1f8933c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565762, "uuid": "fbc58f4a-9686-499e-a1b1-c87988b7f874", "comment": "Malware payload (Mirai)", "value": "d3b242786f705f58b6eedf22a3ed3bbf20a60b4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565762, "uuid": "bbac0f0c-12c2-4f37-b2c7-c193b0acca60", "comment": "Malware payload (Mirai)", "value": "8ddad1d849ae107751c915baa0f62835ff450a3f5af8eb6daae6277021a3138013541cca60831b13955accac07f0995e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565762, "uuid": "916c49a9-6490-4556-9fa4-93f6a8d53a5a", "value": "T13EE3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565762, "uuid": "e960fc29-99b9-4cc5-a2da-92ad0c29c475", "value": "3072:JjpvwdERKjZyMk9GBeRdUZraCX4Dq9r4:JjFwdERKjZyMRBUdUZeCX4O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565762, "uuid": "0e2c6c0e-7f0f-43ba-82c3-8f13d8d4e2d2", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565762, "uuid": "acc4e8a5-f53d-4883-8b08-de77d12826f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565762, "uuid": "02d309d6-e9d6-4dd2-b230-d77ac930eddd", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714f7931-ceab-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764589618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589618, "uuid": "6801c02a-cef6-4297-9d0b-57c7a43ed24a", "comment": "Malware payload (AsyncRAT)", "value": "bb69e269b18f61d0bd754d4e3234e648", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589618, "uuid": "638cca06-3dca-4d46-b8b9-5862e754447e", "comment": "Malware payload (AsyncRAT)", "value": "426fd8cbda5097fbd159476c10aaea55508712928bfcc765fe6b423b57b545f6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589618, "uuid": "18dd798f-bb29-493f-a960-57f0b14504f1", "comment": "Malware payload (AsyncRAT)", "value": "c6ce96d62b059b99ccc098a2c4f9af7fc9e9d42d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589618, "uuid": "cf92602c-5c35-46ca-82b0-8fba33db07d4", "comment": "Malware payload (AsyncRAT)", "value": "de9e8bf7a9f3381b9f5db18ec3645e3ead5c7a53207c488cec82b3ec8f2ae587fa3fa2e6395bc34dcf5017c4375e6082", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589618, "uuid": "ea3e2f93-03cf-4b47-8254-073316ae859d", "value": "T16CE4AD002BEF4F48E4FAAB386D3552114BF0F80EC736D69E6DD446DE2962BA08B51753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589618, "uuid": "ad9cdbc6-7456-4086-af14-f89b11737f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589618, "uuid": "09505ffd-68f8-4d30-b801-c2afe2e20a24", "value": "12288:Y/HWUjNF1rfQ9vpF2cCCDPsvGMgqzumbxFIs:YF1rI9hNCAPsvH195", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589618, "uuid": "0662cc78-fdbb-4f27-8929-0eac53a36ca1", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589618, "uuid": "a51c24a5-c590-42ea-83d4-032b1edd44d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589618, "uuid": "9a2c7c0f-e4e3-4018-8af8-019aa4b221d1", "value": "STXF-COMMOSA_COTIZACI\u00d3N...2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae74d85-ce6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764562844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562844, "uuid": "c22fb1ca-7834-43b4-8176-f886df0797a1", "comment": "Malware payload (Mirai)", "value": "c380d9fb081e8daff25759ffbd193381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562844, "uuid": "b242fdc3-a530-41d6-afc6-0d071012ab0a", "comment": "Malware payload (Mirai)", "value": "44b6c1d1e7526a23c24fa5f7cb939015f40c5cb722b4e879e89ed9a63b6db212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562844, "uuid": "eaad3545-2ce1-486b-9a44-720b4e24cf7e", "comment": "Malware payload (Mirai)", "value": "2c9721d4d9a441ceb7b76afc6ec6d8d77ee6c0f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562844, "uuid": "f2e31b1a-6746-4780-a61b-5fc5fe95c18e", "comment": "Malware payload (Mirai)", "value": "86da4f9e243a1119cf6ccacc33d4ddccad79cafe0ebc57020bc18b94cce4bcbee160de0c91d902794ee5f9c16e09bcc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562844, "uuid": "8d29858b-5e4a-404a-a554-7197e09423c9", "value": "T1A6D3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562844, "uuid": "3f1f497e-bc6e-4253-98d2-395f584b206a", "value": "3072:Y0H21ZnmZUjUGcF9n4FN7njJL3sdugpgy+Dq:Yf1ZmaZ64Ftnj6kDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764562844, "uuid": "a554eb28-df47-4f23-b02b-77efa42dca00", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764562844, "uuid": "7532363a-261a-4b69-8a86-ddb02498fa96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562844, "uuid": "a7f04399-3552-4787-b907-4dfd140d0aaf", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a73a9c6-ce88-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764574547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574547, "uuid": "5f52595f-2e83-4b79-a089-898e136215bf", "comment": "Malware payload (AgentTesla)", "value": "9f431b10cf7529fadaa7cee624aaa85c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574547, "uuid": "1ac9ff70-5f5a-4a9e-95ae-8a7a8fafc91a", "comment": "Malware payload (AgentTesla)", "value": "4594fcc979ece644907fedfb37dbb08ea5f15f0681719c29560aab7efe310e59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574547, "uuid": "95e7b053-c0c7-4dd3-b1c7-93c743ac715c", "comment": "Malware payload (AgentTesla)", "value": "b7130468f7d6d6b28383c8f70746bed2828224b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574547, "uuid": "95a912ca-601f-4c6e-9e91-cf254e670236", "comment": "Malware payload (AgentTesla)", "value": "c60c5a9249e8ee42e69a85e1a970010de55cd23ce123c02f0c92165826edca6f68723aa23736cc426772fb39ec51fe09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574547, "uuid": "1185944e-e05b-4765-9560-e2b71b4753a2", "value": "T14245BF027391C062FFAB96334F5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574547, "uuid": "5866456c-384e-448e-a9d8-7270d821616f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574547, "uuid": "d7f5acf6-c47f-4015-904f-cceddfa5159c", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdakANlLxv2QbjdUg:JPVt/LZeJbInQRakALLIojd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764574547, "uuid": "9b73c41d-5311-4cc8-8dd2-fc59dd0dd38b", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764574547, "uuid": "77923777-ca24-4eab-9af1-c585f89104e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574547, "uuid": "6f846116-3d1d-4ad2-a05b-8ff57429ed5f", "value": "8411052900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2367e24e-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621699, "uuid": "229f77b8-83bc-407e-9463-2ef902f2726e", "comment": "Malware payload (Gafgyt)", "value": "d64994826263708f51176eef7586b8df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621699, "uuid": "b4e2047f-a23d-4387-8c43-ae4259ef399f", "comment": "Malware payload (Gafgyt)", "value": "45fba85b86e49e3afab9453838c915cd478cb0bf01161885b56204b762ace746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621699, "uuid": "c8f7ec71-b08c-4a44-b6c3-172025c0d7b0", "comment": "Malware payload (Gafgyt)", "value": "621dab815a7577549060e6912504f3f858b9ea60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621699, "uuid": "a56c444b-a1c0-4b7d-bc23-1c05a4d4174a", "comment": "Malware payload (Gafgyt)", "value": "472654bf3cd2c4cbefc93aa3ca6d2f30ee2817857a7425df7e1a8d684f65a3409bcdbab62b43021c5561fb0d43dae8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621699, "uuid": "74b04809-ed62-48b2-bbb5-2a53803f6bdd", "value": "T109E3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621699, "uuid": "c8516a47-bf0b-4d49-ac13-c468e3177cae", "value": "3072:syUyaJ3LUQEWuZI3zKZPhJsphahZtwktUm+QVOXFNqOPPe:+3OI3mOphaDtwxm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621699, "uuid": "14d1d174-9d06-45f1-84a6-fd00aa47634f", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621699, "uuid": "52b089a7-39e2-40c3-b823-e6c3303b0f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621699, "uuid": "b7171000-13fd-4924-b84b-e9380b7231d2", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d12172-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1764621279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621279, "uuid": "a90f7736-7d09-4fad-a977-928710068382", "comment": "Malware payload (DDoSAgent)", "value": "86022c58e58ce3182f32e123aaed282f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621279, "uuid": "07f985a8-576d-4df8-829e-7a9c1a649830", "comment": "Malware payload (DDoSAgent)", "value": "46786d58742fd93be9cba4f1b6bb25468f6c4a6ef888355dc780ef730019d7c2", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621279, "uuid": "2a225591-e3aa-425c-a366-111cf1153cb7", "comment": "Malware payload (DDoSAgent)", "value": "cb03ec35da0247f5a4d44572a9a4db63df2b9de1", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621279, "uuid": "f7d474fe-ac25-4813-a11c-d0f0a6901688", "comment": "Malware payload (DDoSAgent)", "value": "9e4b57eb8758d25b5073c31b2af220ce2771d2bee36ec96e8337162f128ccd30567dcdd6e1aaf285d77a4ca6ee2f55cc", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621279, "uuid": "16d51769-b7b0-4114-94f4-ed71fb22c9b9", "value": "T108565B13B6049DA3D2B607319C3152817B3DDE0A6F4A9317E71BF76CBDB63014E2A689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621279, "uuid": "c0e0ab96-f5ca-42af-a293-17300e5ef8bc", "value": "49152:pZPgY+ho15RjmyhAszQjhp6p8AQnWJ3mfSg0Jm+NEj5Er:3PGho1/jPhfzG6QEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621279, "uuid": "e7a50330-a409-4073-92c7-008b45ef09d4", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621279, "uuid": "1b0f9d19-b356-486d-b472-fd9e72140583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621279, "uuid": "eea5e4ef-27d8-4ff4-b28c-4f33e5bf186c", "value": "korone.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83867da1-cea4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586642, "uuid": "26a3ad54-4ff1-4147-ae7e-31cf70d2cdd7", "comment": "Malware payload (Mirai)", "value": "b1beb9247c1673da2e1c8fab04081eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586642, "uuid": "fc5fb59b-bfb1-48fa-a9bc-eee210678770", "comment": "Malware payload (Mirai)", "value": "469f2a29cacdd3bddde0146535fe6919a7c637660fbe9ef327acc872bd83f9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586642, "uuid": "f1f8e325-1280-40e2-a8fb-fb6c96bff674", "comment": "Malware payload (Mirai)", "value": "096d7f995faf1507525a343054ffd05fd41b7591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586642, "uuid": "794069e9-6961-4fd3-b2f1-1cf32d15a98b", "comment": "Malware payload (Mirai)", "value": "a8cde7d1a23c7c8ef852a5d0e90b3bb95e18b6a01eb543ac30315145e7b0f00ce855dd95a0a62ce7cf02ec7aa3b82dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586642, "uuid": "c797bdb2-c865-4856-8e28-fc4bba12490f", "value": "T15DC31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586642, "uuid": "a4b35ef4-6e6b-4919-911e-f2ee57fc3c96", "value": "3072:HDWrFoeatGA596qP98nTma9uk4cIXEuNGtV:HDWJoztGA5cm98niat4XEZtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586642, "uuid": "344f843b-3f05-473f-a220-0c7b5318d73f", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586642, "uuid": "003ae7a0-66d1-4566-86b1-153d38836126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586642, "uuid": "8679c140-5b2d-4913-bedc-6b44f8bc9693", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc2f488-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764602044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602044, "uuid": "fdda47f7-ae04-4722-81cb-8aeb40afe595", "comment": "Malware payload (Loki)", "value": "d5661a66d0decc4dd5ab7a2e3fc4f25e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602044, "uuid": "1e03ee5c-7ce7-4b47-bb92-8a13e3fe3977", "comment": "Malware payload (Loki)", "value": "471745261953e9374e2ce9e42fc725ac1f59add047252e377aed07bbb6fd36a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602044, "uuid": "5f331a47-4eb2-4b60-887e-5826ee1032fb", "comment": "Malware payload (Loki)", "value": "f9486aabf43ad7e36c7f6fb9412404047dc5da68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602044, "uuid": "942d8f97-d4f0-4a50-9b9d-e68cf733bdc4", "comment": "Malware payload (Loki)", "value": "236b3b5555c65065e4150b3fc709e56b41f350fe001372dba48afcafcc7fa46c293b6cbd4bfb32b1930a6091ceed79cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602044, "uuid": "d92b8874-8bfe-4ae5-a5ee-238ecac1739f", "value": "T15EB4129269C0AA94C26473308436CC6185787970DE06766E876DF66B7C703D3FEA7B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602044, "uuid": "5d2744d6-4ef2-416f-abdb-68d980b1926e", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602044, "uuid": "87a9dad8-daa7-4f89-9526-92d55db6d25f", "value": "12288:1z7hU5I5yuNHIgzSFKxWltRohBfSTso93U0fIB0CQp1RI:1f+iN57Gtene3Ffm0Ci1RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602044, "uuid": "1f9b5b30-e4c4-4c72-bb14-695978be1424", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602044, "uuid": "2f50c3e6-880f-4d9a-bb07-a1a9a4cb2779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602044, "uuid": "69104533-5a0c-4733-8e83-fab78f9b07e5", "value": "LKJ876543456780009800000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429c74a1-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621322, "uuid": "76abe9c6-bb86-40cf-816e-616351b47667", "comment": "Malware payload", "value": "c865bffaa7c67cc1ed404af4baf26e8c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621322, "uuid": "db7921eb-1666-46a8-aa4f-eb9a7368b9c9", "comment": "Malware payload", "value": "4720ee78506641aeaf6f5dc471d121014c9db72007acff2712ee1a9d31dade3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621322, "uuid": "25e7acd3-a099-46df-87d9-c2f6087ca9c8", "comment": "Malware payload", "value": "2dec9752d8c9ac61f391ab6ca66a230e122ee89a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621322, "uuid": "0c1b200a-cee5-4b26-adea-40c636cd4e44", "comment": "Malware payload", "value": "610d4d87531745fd8cd3cfc0f5eebec03950a409c63486d7496d21edf4fa2dc315af17f9461bdcdc9620bb3c4a96f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621322, "uuid": "80fa63d2-af43-4002-9665-94d1bac75e43", "value": "T123215C0ACA2506B0171844FEAF83461C724A488B05CF869FF52D61F91F7CD85B26B249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621322, "uuid": "2b21a90f-9990-48f4-b8d8-a3c6d8a38cd0", "value": "24:CRxXaJNIpuhsChuIAGF0IpuhsChuXm/xOR:C7Q7hsJbS07hsJmx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621322, "uuid": "9f6c190a-1be0-40e2-b91d-790ed7bb7f91", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621322, "uuid": "22f1a8c0-d424-4a4e-bd23-9560e2033499", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621322, "uuid": "7833c535-4939-4868-b274-0fc9ae70ce8e", "value": "vtubers.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf99ffe-cede-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764611542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611542, "uuid": "05996f82-6ed1-4cb2-9313-8212ff8d4a32", "comment": "Malware payload (Mirai)", "value": "979eeb99a942d91f4df7a0b9d315454d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611542, "uuid": "3c7bdd7e-6463-4719-a348-4d675f9aa4f2", "comment": "Malware payload (Mirai)", "value": "48415164eebdf791ca5fc97b630d8b3b460e7821c17f00db283903a6b3117f2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611542, "uuid": "003ca5ac-c83a-40bf-a438-c2b3c69fbb84", "comment": "Malware payload (Mirai)", "value": "47d0ae8cb5ffd91fc9710c4ef214183f7498cdb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611542, "uuid": "150a97ed-043f-4332-8b23-16248cbd1c36", "comment": "Malware payload (Mirai)", "value": "07e285edbe3b4aa0aad9715e4b24df31067f6f34271246dcded3401fb3234af1cf41d4383c57548962e576c168efe8d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611542, "uuid": "257ef96f-b776-4ebd-9861-929502c4b54a", "value": "T159932855BC829A17CAC0137AFA1E42CD371623E8E2DE7213CD259F21378B95B0E7A591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611542, "uuid": "e31a3a44-159b-4b4f-8da8-a459ba5400a8", "value": "1536:zhsywo7PhwA5wSiPGFFf89MpXsg0shqDjwk4Fd9wjMtqnQ5OsvGBP:zWy17PhwAqSiPMFfScbwj2LxGBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764611542, "uuid": "dc2fc334-4fe5-47d5-957a-bd8447a7c66f", "value": 96784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764611542, "uuid": "332229d7-e79d-43ef-9248-dc9942313c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611542, "uuid": "045025f5-1cba-48b5-83ea-21bf0ddab90c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2795325d-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621277, "uuid": "5cb3c658-ddfb-4172-955c-d3450b78b38d", "comment": "Malware payload", "value": "8637269acab1d333d4d58f12442d5bf3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621277, "uuid": "bd4dfbc6-69f1-4d93-976b-928365bdf7fa", "comment": "Malware payload", "value": "4bb5107629080ccccbf8d4a150467f4979aa260c4d6096878c0d42c12bc85088", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621277, "uuid": "263ab968-69aa-4343-a453-8f2b4c4d7c3f", "comment": "Malware payload", "value": "3c3177f07d1463d0bb67c7146e95b00e57335923", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621277, "uuid": "42553bc9-6aa1-438f-8379-296b73f967b1", "comment": "Malware payload", "value": "434e7646caac05b8e7c9ca6f2156e58a1e986e6d4db27e3d20bc5f69612fede4d78e3bc5c27a40cf9618a1a7f44f8f7a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621277, "uuid": "0e18acbc-7877-4b87-8787-d2f497276f95", "value": "T10126F18BFB49592FC87B14F249AE523116578D178E839B436C48321C68B76D83F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621277, "uuid": "c3e83db2-0b3d-4d0a-8bd5-0d204c9e234f", "value": "98304:ApaXL+64cLxNl/iyypjXkLzq/64luh+6GUUifyFBlgLCr4Nb:wab+yxT/Y56yHxNoyF+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621277, "uuid": "08f39e31-f5fa-48d3-b032-9607de4f4a82", "value": 4794590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621277, "uuid": "9d0eef61-2399-428d-978c-7ddc0be1d005", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621277, "uuid": "bdd4d8c0-334b-4509-85dc-2b840dca149d", "value": "galaxy88new_1.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bc851a-cf0d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764631607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631607, "uuid": "1f2dc293-f4a6-4ec9-918c-50e2e50143f4", "comment": "Malware payload (Mirai)", "value": "68bd7f2ab40d010f33e5d621c6c6d79a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631607, "uuid": "383c5274-7dd6-4b31-b59d-95fc7e16a686", "comment": "Malware payload (Mirai)", "value": "4c047ad8042d6ea8e338e77b133cdf4be8ded4734ba150c3bc2865812dca2a0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631607, "uuid": "b8a4fc1b-38b3-4bcb-b6e3-20e5f9261d4d", "comment": "Malware payload (Mirai)", "value": "5c3aeaa3667d9dc22efd173a2b5ebd5a48f06078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631607, "uuid": "848e152a-e00b-497a-b822-edb0eedaaaba", "comment": "Malware payload (Mirai)", "value": "b09a5c648e90883705ec3a793027b8600de26161eb1aa16cfdeba79c6b7c959798593b90ca4fcbd9032113de9d58321f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631607, "uuid": "c9c4d61a-bd44-4507-aa86-78e8c7a44734", "value": "T14D83AF67C8656C88C66846B4B9A0CE368723E424E1D7BEF2529BC7758043FDDB90D3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631607, "uuid": "25aff20c-c6a8-46b1-849c-e6649c2cc328", "value": "1536:y/fvNY6TipuUxgHEL2pWrP7DaKj3wWl74J8z27YYRsCqJ282MHJB:ynFY6mzwEGy7D9jr3z27YYRs/JTHJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764631607, "uuid": "a791ad8e-e844-45ba-bbdf-672e6b831c8c", "value": 87772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764631607, "uuid": "27ba2c84-5b35-43b7-a847-87238498b8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631607, "uuid": "983df325-d9ac-4981-973b-351793acdd00", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a388f17-ce6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764562843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562843, "uuid": "1caa1041-4582-448e-a646-a2016721d8d5", "comment": "Malware payload (Mirai)", "value": "b65a314839f22a973eef502def6d84ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562843, "uuid": "0504f792-4192-4033-b8c8-0b76cffede35", "comment": "Malware payload (Mirai)", "value": "4ca0d670752b6ef68b9dc0af8001458973a7cd7bc990ffae6d55907b89aca83c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562843, "uuid": "4844c612-4309-40b0-b3b5-c8a8ccb9a35f", "comment": "Malware payload (Mirai)", "value": "3a289fde81df96283e8f610c6816a6f98bbb2865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562843, "uuid": "e9a6aff6-a47b-4b53-8ae0-b8679001e961", "comment": "Malware payload (Mirai)", "value": "664f8e36683a0e93f8ef87111878776da2b5a0db099ebbbccc24ebe68fdfaed5b20f2f5cd549005fb46bce68a036abb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562843, "uuid": "95c49883-7f36-4030-af86-e29a472fac1d", "value": "T1EE63F23265662CB05B705837BCFD8341FC6F8274C1A5E6F2A213987D314AF9345BBA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562843, "uuid": "6286afe2-6085-4db5-a679-3dcfb70044ae", "value": "1536:iYWnPpMi9HTxtbf/+BVxLMXtrNgyqZPpEqmGPNxRiLJ6qxXXDvNdI9AEqRV+:iYWBMUTvbe1MXtrmyqZRUGJiLJ6qxxdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764562843, "uuid": "efb6c962-0a8f-4052-8c67-cfb041439c71", "value": 73256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764562843, "uuid": "2a361804-4d87-48e2-83e7-d9090cb1c70f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562843, "uuid": "2bc05dc1-b396-421b-9524-37159e929ecb", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778e4244-cef0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764619264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619264, "uuid": "e082f991-e987-45f8-b232-24f1fe075ea1", "comment": "Malware payload", "value": "f8276d4d3406c5df2329f395fbca8f1f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619264, "uuid": "26bc888e-61dd-4877-8d72-81954f2d50b6", "comment": "Malware payload", "value": "4caf2a7831a78d5e22fee325aef6b7aa350b43226c7392fa086a2f5cd13c51f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619264, "uuid": "da4b0ac2-6248-45bf-8a46-39b10e81841f", "comment": "Malware payload", "value": "4ec1f3a5f7e0c9ad27ff9225bf77c922a4a0b639", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619264, "uuid": "46530548-e428-4f4d-85e3-74fc616db083", "comment": "Malware payload", "value": "035dad17c3e22dfc2aa4675507d2e02aee7b3b4fc3cc87dafd87037a3d88ba3f8c5bcd0dbf022d4b1ed71e6a881c3060", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619264, "uuid": "5118feda-9973-477f-b017-f485b39a33d4", "value": "T10FD4120BB3FA35E4D2F28676C9100A199B7AF57146A49F2F07E447AE1F5B5408C2AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619264, "uuid": "0edf886f-acb9-4030-8944-caa7499c1759", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619264, "uuid": "b6a5f8b5-e348-4167-b782-ddc94c947e58", "value": "12288:JSuCbRfsiRSmCsdcah6NdHN0ych6j8lqrksKXAYBv5rxo:JzmsKxnh6N1NVnj8lqQLfju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764619264, "uuid": "82c0a2b2-ff3e-47bc-b5bf-9aa598bfd2d7", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764619264, "uuid": "a4ae4adc-b7ca-4de2-a8fe-f9ff6351e076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619264, "uuid": "09926c6a-7ffb-4deb-938a-582d2dc3de0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd5a33-cf02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764627061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627061, "uuid": "23f107a9-ac43-48c7-83b2-afe76c508567", "comment": "Malware payload (Mirai)", "value": "a47f24ad14d2af8023ee370be2e2dc41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627061, "uuid": "9c3aa1c7-fee6-4347-b868-208a1ddb0e05", "comment": "Malware payload (Mirai)", "value": "4d30c173669f5542889d3cc4cdf2071972605f79804614fe1ab5b7db0c77e9fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627061, "uuid": "bdc50537-435a-4a7a-83d2-db7e4e510393", "comment": "Malware payload (Mirai)", "value": "6c59bafaf7ff98e15337b8e81d5d4bc67c7ee069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627061, "uuid": "18dab0cd-c4d7-4c46-93ed-839013735568", "comment": "Malware payload (Mirai)", "value": "19f251d5b34b7e211d1605265bc12d68f11e6d47b55cd256f8212a9b2cda9d40d81757e71c11fb2ef63d16b93ddd2cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627061, "uuid": "4b47679b-5020-4603-8809-cbd2fd38bcb2", "value": "T19AA32A95BCC29A22C6E063BBFA6E418D332563E8D2DB3217DC255F1533CA91B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627061, "uuid": "c31c8442-5550-42f7-861f-27e51ba84a40", "value": "3072:Uhj+aVMcVHBSWNXwIMMvGAhV7e43T+RP9/u:Uhjrjv+n/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764627061, "uuid": "00d8c48e-73b6-40cf-b7c0-c7cae059d28c", "value": 100328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764627061, "uuid": "4f355bac-320e-40ab-8e99-71a5710e8aba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627061, "uuid": "9c814086-f9b4-408f-b68f-5ce1d0d0f96e", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103ee686-cf07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764628969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628969, "uuid": "8cd850b1-01d8-47a8-a42d-a8733a89401d", "comment": "Malware payload (Mirai)", "value": "bf004d88a803a82b9a9c098927ac4f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628969, "uuid": "d6d82fc7-0490-43b5-af17-c3cd3658661f", "comment": "Malware payload (Mirai)", "value": "4d41a9967f0da9235e8c27831ee286ba0311c378e00370ff2fb56180f4ea5ebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628969, "uuid": "d5d34fae-a671-45cd-8f2f-f21061fdda24", "comment": "Malware payload (Mirai)", "value": "edc95fb9200d1349047306601cc8e64fddafc8bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628969, "uuid": "a5a7e4ea-0b09-4d5d-ac48-25c6cb9c37ac", "comment": "Malware payload (Mirai)", "value": "fa40447c94cf00f26a1a47f43dd5a1a6e7adf32e6a776823e4f05e6f76f3a2070443e7261f41fcb08c9134fe97da7413", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628969, "uuid": "2b719493-8a9c-4458-b0b9-60ae2304a09a", "value": "T18DC2E173E9437465E5702C74C53ECA80339E459CE1BA3127B2388B7418FBA9E36A570B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628969, "uuid": "0c5a8f83-39fa-4017-b818-8c342ba9d499", "value": "768:3Y9EmeYBtkYNUjcJMnAX/X6gnTmZ4ds3Uozu:o9C2NUjYMnAPhnTmpzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628969, "uuid": "b4df783a-0bc9-47cb-a373-541d1e19c1cc", "value": 26420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628969, "uuid": "c32dfe8f-bdb4-46ec-8cb6-db4bc48964f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628969, "uuid": "be10b0dc-7759-4ed1-8aef-3316900552bd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac1ad17-cf08-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764629684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629684, "uuid": "166f12fe-ac63-4b6a-8bb9-0492b01bf9fa", "comment": "Malware payload (Mirai)", "value": "6ee5595e201fdf898186f7ae8a3d1855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629684, "uuid": "8165e87a-bd09-4418-81a1-b5ba9963b35e", "comment": "Malware payload (Mirai)", "value": "4e0f03faa3b390996e0a5629f97e3f1aaccab324f03065f2b459d23a2707b8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629684, "uuid": "43042dce-32e6-43b0-bb4a-313c5ed335f7", "comment": "Malware payload (Mirai)", "value": "640812278c9fd5e8b85c969d62900daffc8d5e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629684, "uuid": "8f811e8a-6fdb-443f-b203-49273bc3e206", "comment": "Malware payload (Mirai)", "value": "6f9a06e2198ff4dd555b2c9d0156b2bcfa4c924df8820a5ccb2d193558106f1a23d99e999ffb605bfb1827d768b29450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629684, "uuid": "61829775-7f2e-4ac3-9dbe-026cf44c419f", "value": "T13C935D02B22C0A47E4A35D74293F17D193BFE95024F4BA89695FDB1A8635E331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629684, "uuid": "4937e3a9-b863-40a3-b868-c96ffddaab74", "value": "1536:U7f3Kt1Th0c0sJbVLDVt5MYoJz3DBJj9QHiOTSqo296nimF1fropuRBSC:U7f3Kt1Th0c0sJbVLDVt5M3tdOHZXmF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764629684, "uuid": "67efcfd3-47b3-47f1-ac94-68ceca2c86cc", "value": 95852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764629684, "uuid": "8479bd4f-18e1-4685-9bfb-85fb84e8584a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629684, "uuid": "8e91751c-b9ed-4797-8dda-6b8fda20b4d3", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e33da97-cf02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764627059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627059, "uuid": "d65e5c37-6751-4d8d-9bab-4f342dd510ae", "comment": "Malware payload (Mirai)", "value": "521de995625956a7a9afef3cef4ef83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627059, "uuid": "dbc47bbb-6f79-4807-999d-287db0f942d0", "comment": "Malware payload (Mirai)", "value": "4e829e523a83fce3b8ce9975fa7f57555af136d434dbb9600f93d637503f553a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627059, "uuid": "e963cfcf-313b-4e16-8689-86aa7a2a342d", "comment": "Malware payload (Mirai)", "value": "90babc23ab0baa60391b3bc88d579562048d236e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627059, "uuid": "bd13c585-ea7a-4479-8dc5-6aa04bf99445", "comment": "Malware payload (Mirai)", "value": "eacb3c0e780108af6e78d0bb093b160da3f70e702f1b9e28b49ed7f69126c94ab825f584b17f07292c674e6b306b044f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627059, "uuid": "7f40c2d5-4204-452a-8b52-9fbd1ba5452c", "value": "T126A36BE6F400DD3DF85AD7FA40270A09B92093651BA30F3B969BFDD33D721A85A12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627059, "uuid": "f40b8c47-afc7-43e9-b88b-07fd4c8b6ea2", "value": "1536:5nybbdYDIae/l00fTnGnF8NYvxqvjGpFcZMDXfTvVQvZCPAm:5u+I3/O0fTnGnxTpea7IZYAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764627059, "uuid": "b6c60683-c9ff-44fb-bcec-4945fc2f3869", "value": 102004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764627059, "uuid": "6a803fcb-d698-4c38-9018-bc265ecf0003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627059, "uuid": "35bed907-ddde-44b0-8557-7ce08a2a45c3", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47de95d0-cefe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764625197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625197, "uuid": "974a9e99-13c4-4ab8-9328-41aef30c8671", "comment": "Malware payload", "value": "a3202eae81802e9a0beec4720522cf60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625197, "uuid": "36d7981a-02c1-489f-9daa-23cb314d2090", "comment": "Malware payload", "value": "4f3b8971d6c985125cc2cb1fec0ac5e700219510a84f991a7481d060861ea0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625197, "uuid": "f27531c1-051a-43ce-87b1-4b0e8a7a2a42", "comment": "Malware payload", "value": "997d9764eef125c2652e6e080b6653b7190b7133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764625197, "uuid": "53093ccb-3ff6-471e-b643-b8153b731ddf", "comment": "Malware payload", "value": "2ff0a867e21773cb0c18a463ba65a130f9d8754c9e6571ecb64f160dda7503735dfbc53d0a9ee9a4ce977be4eaf06c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625197, "uuid": "906f63d9-4b5b-4059-96a5-960f69e83d9d", "value": "T12CB733AE679820F2E496607F9AAFE816957AFC515BC4CB8F837042603F475E0493DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625197, "uuid": "d73aa6cb-7263-48d9-8583-be65b30e156d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625197, "uuid": "adcf5acb-0bbb-4ef1-b48b-f91308a385a4", "value": "393216:MoS3UU5JxSaM0tjSqhIM/ozBhUNyp4g/w/3cIebnPi:MoS3UYBSqh/wzB6NW4wwqTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764625197, "uuid": "ce99d2ee-5d46-4b30-92bf-94a50f9db246", "value": 50085121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764625197, "uuid": "bc44db3c-d125-4374-92df-0b10925db633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764625197, "uuid": "bf912d1e-fd09-4dbf-8a18-80928db2183d", "value": "sdas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bee8c91-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764598172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598172, "uuid": "7581353f-ec6b-4e52-b96b-db39e90bc30e", "comment": "Malware payload (RedLineStealer)", "value": "703f58d027b7c7f639a40a857e26c1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598172, "uuid": "26dd80fc-d6f0-4a50-9469-95395feb72a7", "comment": "Malware payload (RedLineStealer)", "value": "4f5699c07878fd3167f5c40107803b1fe6f9abc13d94c8dcc3d14d3eec594e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598172, "uuid": "fea89e31-6519-44c6-ae2a-67cf31f68214", "comment": "Malware payload (RedLineStealer)", "value": "989d6c6d254e62426c5261bb2c253c417aedf27b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598172, "uuid": "c7d1c2a5-6a0c-464b-baed-dabc1efba21b", "comment": "Malware payload (RedLineStealer)", "value": "66d5a22a0ca67d1afa1d2bde306130a6e380eb9197b35ca21fbc0981fdd32d29c5fb00751577d328a17212c9b58e577a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598172, "uuid": "2d9cbe75-16b5-4417-a935-d76a430cbaaf", "value": "T12245BE0273D1C062FFAB92334B5AF6115BBC79660123A61F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598172, "uuid": "fa9a0a94-0c97-4dba-a9a5-4dbcf2688ef8", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598172, "uuid": "018d7588-19ec-45b4-8f68-d934873cb221", "value": "24576:M5EmXFtKaL4/oFe5T9yyXYfP1ijXdawFd3erZj2jkc3:MPVt/LZeJbInQRawL3+Zj2jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598172, "uuid": "9bda2dbc-c4e8-4b76-87db-d2d4841f5f0e", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598172, "uuid": "130a935d-e61a-4bdd-8070-41787f97fb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598172, "uuid": "2b222e4e-bf6a-408b-b9d5-9f7afe632226", "value": "New shipment 83017409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735f4ece-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621834, "uuid": "4510ed4a-b85e-4298-96f9-0b07108c4940", "comment": "Malware payload", "value": "d865af875844be585d68ab1992008e07", "object_relation": "md5", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621834, "uuid": "90a12ec3-2f7c-40aa-b699-965d0ca98051", "comment": "Malware payload", "value": "50d013909a4d72df81683b40a9ea3fa0a733403e46bad4a8e513cee0f26e8bd9", "object_relation": "sha256", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621834, "uuid": "99e36ad2-aa4d-407b-a6df-c4d64e1e7f2c", "comment": "Malware payload", "value": "b1e58e71b957dea0c15749136879daafe9364df7", "object_relation": "sha1", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621834, "uuid": "c9ba79c2-1862-4c35-9cb0-68eea89dcba3", "comment": "Malware payload", "value": "d829a48156a1377466e4d8e74f1bd4aa9334247e8b93602706ba760bb88e969ce8f22abc7a85768c7e09134d7b5393c7", "object_relation": "sha3-384", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621834, "uuid": "5be4345f-53b2-4cf4-a7e4-4dff86955195", "value": "T12547330CCBB88564E0AFDEBC10CB672AF7602659D732D31B4A9E19505D937E907E231B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621834, "uuid": "f78df272-6d74-4453-82fd-cb088f5844d0", "value": "786432:OL12BlR++Nf5lN0MwrvbWeVIiSOnKTRGSrsTl++NCX:OL12zRNNxlNgKYfnKTESiNNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621834, "uuid": "81cc0266-8200-4d0d-94e2-3b6f872c9c06", "value": 26188065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621834, "uuid": "9bfd9ead-cb03-42b2-b13c-cb426698ac1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621834, "uuid": "9275ea8f-b24f-4f4a-b03f-c77392f2d272", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a299a95f-ce9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583688, "uuid": "790aa160-2339-4e26-9026-1eef0b3a3309", "comment": "Malware payload (Mirai)", "value": "0b4f85284c53ccb08b45a8a265f5b8bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583688, "uuid": "2ad6182c-129e-4d61-ba9f-8ee3378cc30b", "comment": "Malware payload (Mirai)", "value": "514de348292887241ff3aed036355d4105c4b917ef1fab97b3f2b138915bd42f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583688, "uuid": "ef10d322-830b-4a81-a3ea-362d85008987", "comment": "Malware payload (Mirai)", "value": "6178d9fcf0dea7d6fb22a6ef31dc871c78f639dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583688, "uuid": "cdf751d5-b554-4679-9ceb-3f00b2948a26", "comment": "Malware payload (Mirai)", "value": "acb51cf465504b8995356b4dfc2b1743051d2f0fa556c27e5a057bb11fdbb2c1d529a24f4a33b2c6cd7a95f766f7a016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583688, "uuid": "197146e4-cb44-43d7-99ef-dd18fd926bb6", "value": "T1435302B67C7E723DFECBC63C4A79938E42329A441C68BE351A48F8FC31141366D45982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583688, "uuid": "c63c54b9-9839-47b7-9453-ff59049a4f7f", "value": "1536:72Hol4QFhYBaNN+t+lKNdiLmk44zFkq28fpz6ImAQB:72IXDqan+OKN2mnShJQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583688, "uuid": "a7f39000-72fe-4844-8fc6-2b792672fb0a", "value": 61256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583688, "uuid": "a865a5c4-00d7-48e1-ba32-d931eede7d30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583688, "uuid": "0621e215-9ac9-458b-a248-f8c0c6c4773d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa27e0e4-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764591002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591002, "uuid": "e14bd8cc-e35d-4619-9b08-1a7c34eb6b1c", "comment": "Malware payload (Mirai)", "value": "35fd299cb4a8e42a906f407ad1e8bc6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591002, "uuid": "e3a7d9f5-25df-4fb7-a1ef-ee9b98fb7a7a", "comment": "Malware payload (Mirai)", "value": "51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591002, "uuid": "3c933b29-db1c-4039-8789-8f3fdb664903", "comment": "Malware payload (Mirai)", "value": "4a7d316451e9a189c0ea9a98398076a3f35752b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591002, "uuid": "186ce577-6138-4fa3-8cd1-2afc588f1187", "comment": "Malware payload (Mirai)", "value": "3202773f64462a9f1398f686c921a3f4dfe02ad6642527cfc49314b340b48b5f8ea13155e328657553104f19853a6189", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591002, "uuid": "b8d74c76-7831-4405-9e87-625646891188", "value": "T17B51F38F042C2D0AE72DCB1633B36D4653A847A951A7CF9EAFC026375C48A5070DFE22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591002, "uuid": "cdb797b2-dfd0-47be-90d4-b5adfe4762f3", "value": "24:Ymfbj8hps1/mKDee3IKNIym/lAKs/A6xxpQ9P6oYNIkKXgWX+85KPS2ef85eQe9f:VP8TsxglA9A6xx4P6oirWX+kl8Xne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764591002, "uuid": "094648ae-3926-4af9-b62c-62f91ccce10d", "value": 2458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764591002, "uuid": "284bedb9-c666-4f9b-8804-ed8035054e10", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591002, "uuid": "58fc07c4-7e29-496f-b881-496eb02fd18b", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82e2d05-ceab-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764589817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589817, "uuid": "075a8d52-16c7-4072-9c2a-32825243ac6d", "comment": "Malware payload (RemcosRAT)", "value": "45b4b86d459f2947a92970023dc24c00", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589817, "uuid": "26a1caa1-39a9-44cc-8421-492fa4b99361", "comment": "Malware payload (RemcosRAT)", "value": "523796b8e4d92e3eb1fdcfde7d3cd2e1861bea757a4493b3736cc6ca93c9ef86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589817, "uuid": "4a941de7-e61a-43af-b0b8-073c74b97ae2", "comment": "Malware payload (RemcosRAT)", "value": "0f0c183369722390813b03818a51c3197c11403a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589817, "uuid": "5384f05c-68df-4514-9dbc-47814c4618e3", "comment": "Malware payload (RemcosRAT)", "value": "f0de246b6e83303e7c9002f195196bcd205f46a682f184890daa96fbd67076dccb4236192a23a65f37e7834926355b62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589817, "uuid": "13b7dbd3-2e98-4060-b314-8452d121a0ec", "value": "T1C1055B20DE68136D4E431BADFCA4136189ECC609513695F5FADA034EA1068FCE3BE779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589817, "uuid": "152bedb2-bae6-4e81-8395-4d75bdcc6824", "value": "24576:3/EC/E8/67/K/o/Et/C/Er/w/4/M/Ee/ET/E5/5/Es/EK/K/q/EW/+/E6/ER/Exz:3n1y7iAA6CIwkbWExXviiD2RWylNknNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589817, "uuid": "e7354303-6e5a-484d-90ac-996ac793c7c2", "value": 872984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589817, "uuid": "7d3ff39e-0509-4969-9e78-a4fd15f7c4a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589817, "uuid": "876cf0b6-f538-48dc-90a2-7fc03555921c", "value": "Bestellung 240643552.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ef76dd-cec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764598799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598799, "uuid": "52d8d1d6-168c-40d4-afc2-4e300b12a688", "comment": "Malware payload", "value": "ba3b51c4c81c3e3d32cfea26c017d7b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598799, "uuid": "1f914137-a991-488c-87ba-60605b97c242", "comment": "Malware payload", "value": "533c0dacbfa3143e98d9651a7b6c0b431040749ae28e04f681d7b610bdbd8a33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598799, "uuid": "04ab7cc0-a20a-409a-bb35-b7bb9f2cafed", "comment": "Malware payload", "value": "397380a8ab8df08725aaaf401f13660d5baac527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598799, "uuid": "0ebef437-d19a-4705-87be-3531a9bc3a55", "comment": "Malware payload", "value": "61c6b898476757b9611fb1a4685f65829f06de9993c38931a22eb41e1ff50ec2ec4129246def084cf2262171150b908c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598799, "uuid": "9d5fa7f5-3fcb-4b27-8512-f83121c1a74d", "value": "T16FA30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598799, "uuid": "d3b90211-f78f-497d-a29e-5076f291184a", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYNx:FOuhPHCKsqZ9YfM6g23ZJLYNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598799, "uuid": "79df218b-f9d1-4c94-a770-840a78d406b4", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598799, "uuid": "645ad437-6c5e-442c-ba34-131d678a6035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598799, "uuid": "b9030a21-57de-4734-b509-fa9bfacb0abe", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef1840d-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764599761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599761, "uuid": "4df17e4d-b6d1-41b3-ad45-cbcbb9466dc7", "comment": "Malware payload (QuasarRAT)", "value": "75b879119ba9e7a7e70c0652635372e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599761, "uuid": "ab129b04-7100-4506-97d5-820944d9f1b9", "comment": "Malware payload (QuasarRAT)", "value": "53bd45a2da8a0db00c6202fd66651bde1b5ede0cdee998654c64d037ccfa9b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599761, "uuid": "bca94f28-09e3-47bb-a1d7-b216366905ba", "comment": "Malware payload (QuasarRAT)", "value": "80e50a578256a114e7422de9abf495f5d2cdebb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599761, "uuid": "cfc6a482-a98f-4eb5-bc83-c87a27d38bb6", "comment": "Malware payload (QuasarRAT)", "value": "e99fa6dc259b69e923a227cf30937b1f0e450bcad2f71a3da72fde4f6e9a6432247dae0ef92fd67163989b1c0259cdfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599761, "uuid": "2675b004-8287-4eb7-85dc-294a99efac7d", "value": "T1A8F533DF320175AEC067D4368AA66C70A6616D7F6706D207881B3E1F3A3D6C79F214E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599761, "uuid": "5e64448e-32e6-4f66-92a4-2716c0beaa5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599761, "uuid": "95b387dc-3b0d-4b04-8647-30b405a43362", "value": "98304:cm9yZooTkL/oxmlkXDIe9eXrODgFRHW+Q:cm9yhTTIeebOIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599761, "uuid": "09ca8093-0c66-4b40-bdad-649f7b93095d", "value": 3399168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599761, "uuid": "adfe7a9e-f213-449e-8c09-fb402f96bb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599761, "uuid": "cf362560-d819-4196-911b-8acd3f262aec", "value": "Outstanding.Payment_1122025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7169e8-cf04-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764627894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627894, "uuid": "4a3774f6-8f53-4fbb-a3c0-bd934a5bae50", "comment": "Malware payload (Mirai)", "value": "c55d600214527df099d76d867402b421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627894, "uuid": "bb9e32da-54ec-4a4e-a165-6caf44e61dd0", "comment": "Malware payload (Mirai)", "value": "53d85b8bfce83f79cfd1ee12c3d2a8295f89ad3260f363ab091ca8d2babf8bbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627894, "uuid": "6ce087e8-2293-401b-b9a5-73c104f5dd4c", "comment": "Malware payload (Mirai)", "value": "b07b7f766fe2d822052b591550bd81ef3df11caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627894, "uuid": "4f50fa01-65c3-4b92-89bd-110b10de076e", "comment": "Malware payload (Mirai)", "value": "10adb7a04b59ff8bff60fff85ffd884f430562db03a6777c283caa074be3db00d29d24bce0c3c9c5190d2beb810f0153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627894, "uuid": "497624d6-a518-4f06-bf95-9be2eb3d5c2f", "value": "T1BC83AF67C8146F98C0444A74E1F29D7C1B33B51482272EFA99C5C5AA6883FE8F60D7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627894, "uuid": "5d164ae6-538b-472e-8590-53d4ded619c0", "value": "1536:AaeQ1Z1poI4Rma55ZHUp9G4zp5qq6/NgwVoQClzK1HDAWS8lBHCN+Ju:A98/poI4Rma552dzpAMfQI21TS8PIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764627894, "uuid": "52b3e940-a958-477c-8fce-843e1ce6a9de", "value": 87812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764627894, "uuid": "af6ce6d6-edd6-49df-9100-2bd9801160a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627894, "uuid": "48ed5fab-9e98-4814-8060-8d05016b5499", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e489e0a7-ce73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565759, "uuid": "09d60034-a2c8-4263-a319-42759f3e8f0f", "comment": "Malware payload (Mirai)", "value": "d88cf108cefc9bc6659f0c1585f51d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565759, "uuid": "7a5f5816-4db3-42d8-ae23-88db24917cb5", "comment": "Malware payload (Mirai)", "value": "547ea1d56db872ee7652e62beac263be4acc46b117a7185aa008ff9f61eb589e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565759, "uuid": "1b69fb67-1de2-495b-a04b-348be3800489", "comment": "Malware payload (Mirai)", "value": "03ad8b294fbf04ef1b39250f4ac3185fd2c15e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565759, "uuid": "cbaa1821-f2f0-4fc1-8a30-a15523786291", "comment": "Malware payload (Mirai)", "value": "18feb38d20beae10b433db268e411d56616241b04ba762fe475ce3a994cf9eec146543f4eacdc558db65884bc1c5d88d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565759, "uuid": "56533174-b086-4134-b706-fb2725358669", "value": "T148B33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565759, "uuid": "a3661533-7b93-4115-8667-6f735acff109", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1ga4wP6Ks/XkmSlx3lJX6s03zxsvAx6vB:eZxMi6xWSa49jSlLJ6iAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565759, "uuid": "b9a6b8dc-859b-45d2-8b64-d231dc08d373", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565759, "uuid": "1d8aed50-9c93-4376-a24a-0b4e81f63601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565759, "uuid": "448ed2a1-2734-425b-b22c-28db009f9b12", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574c96de-cef8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622646, "uuid": "4061c7d7-76cd-4889-a12f-37e221d432ae", "comment": "Malware payload", "value": "9239508129e951ca71a7680e45d8b6f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622646, "uuid": "e1d544a3-9ce1-4510-8107-915e953c7cc1", "comment": "Malware payload", "value": "54f91672bb25e50af5215af8493f1a082fac78e5f8eb23b1686f17f28e098fc3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622646, "uuid": "c980344e-e991-4e9b-b469-36b62bae3d2e", "comment": "Malware payload", "value": "92c7c8482a6b9a1a2f3a884c0aa00939cd250b0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622646, "uuid": "49d3d546-7205-427e-a8de-69442d59e42e", "comment": "Malware payload", "value": "15bc4d2e0de39c0fc1b19e3c93b58e32632e9b0a960c09fb32b0462ff44a2a90764d5778609e24d2ac8244ccd09e37f5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622646, "uuid": "963811aa-2abc-4e70-91cd-de6dbe5cc747", "value": "T10673645C0ECB88FCA53B799886CF8E05F7E99813221CD5E4FE5DA9A02F51428A1F45F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622646, "uuid": "9637c2a1-adb9-40e3-9de5-c4385ca39ef4", "value": "768:W3sEtOA1opA4JJlYE5e2NGcRR1Ivhe/PeHRwqc+qc+k4y1q8rZ3kXurEKbrjpRMk:WaAqlR1KLRwqNqNkRt8vjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622646, "uuid": "badc17b3-b78c-451f-a33b-2b1da8305e4a", "value": 77606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622646, "uuid": "6f4d67f6-2e83-44ed-8608-56617003072d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622646, "uuid": "6d686f19-3455-4c13-b600-b50731efccb8", "value": "newSide.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6463484f-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (Spyder)", "timestamp": 1764598186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598186, "uuid": "970ce098-82a7-45b7-8d77-288c6ddbd2ad", "comment": "Malware payload (Spyder)", "value": "0f9532944b79fc4da8a9383d75a1dc13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598186, "uuid": "2575b892-08ca-45be-ab92-2557401e4fe8", "comment": "Malware payload (Spyder)", "value": "54fb4b99a4a45338809ee58a3ee43bf0bd9cb97b356c466cd19a87497f216985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598186, "uuid": "6eba559e-9c2e-44f3-8111-4f6c34a2e29e", "comment": "Malware payload (Spyder)", "value": "4e128637fd398e55f1566029ad4b9b6ae673e760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598186, "uuid": "49e51dbf-41af-4ddf-a174-360589a19383", "comment": "Malware payload (Spyder)", "value": "37c2aa7740d9af467f5ca40f8857b35cdad7905ca33f1d57e36d413707b4c8c41d8ae7a4e72f936cf637657d8e8cd6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spyder", "colour": "#7DFDA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598186, "uuid": "1a2fa5b9-6477-4f44-9d58-c9c1eafeaa2b", "value": "T1A7E5AE06FF8295F1E983027951F797BF0D395914873089D3DBA529AA98312D0AB3F39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598186, "uuid": "e762d91f-874a-4e3e-857b-4cbbd86d330b", "value": "a94d77c8ed69dcd9717aed8879f0aca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598186, "uuid": "d2e494c3-3c3e-4492-9c4c-bae0bab21c3e", "value": "49152:YbWOTXAHm5QVBy/+CdisyeQZdQ9cnvO1lkkPc0vz65UKCsh6cDpTYsm:YbWOT8+0xNqeol60R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598186, "uuid": "5c6a487f-30a5-4f93-9b69-7960689dfc8e", "value": 3076696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598186, "uuid": "6235e2ba-d401-442a-b872-8f72087f7a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598186, "uuid": "ce386634-a89e-44f3-8ec2-b79d93fbd209", "value": "MpDefenderCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57edb32f-ce6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563806, "uuid": "a0da1961-e9ee-4cdb-ada3-ea9d3fcac98f", "comment": "Malware payload (Mirai)", "value": "e7b707f3ca3650796a2b14cf6868b7ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563806, "uuid": "fc85c6bb-18e1-44da-b664-694b51808985", "comment": "Malware payload (Mirai)", "value": "55270354a25e6f143ab99369d1e5129dd6a9f629924aea60f59e520b79cdb4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563806, "uuid": "01caddce-c4ff-4771-a87e-992d6a41288d", "comment": "Malware payload (Mirai)", "value": "c5db0180c858aebd9b910eafe5b8dcad8032f3c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563806, "uuid": "3a6319e7-60a4-45c5-a64f-8c835540cdcd", "comment": "Malware payload (Mirai)", "value": "933f164362e4e35b8a138d6184073be419d79a10cee7ad5fe55a731b9949bdf4ddbe2f60dfb6033f8fca3ef4425075f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563806, "uuid": "9e7e0b4f-6c2c-4985-98a0-cf0b9c7ea82d", "value": "T1D0D2E11626417CE6E221DD73CFBC49C326A9697587FB006631A44EB6EE1D25DB4F8303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563806, "uuid": "7c2a7da7-943f-40bf-a853-1dcfa6f98f11", "value": "768:gSqEkxgmuaN5QRrY31/+6v1jxDs3Uoz+ae:gS1CuaQRrYFma1uzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563806, "uuid": "323ea548-79dd-4f10-a388-4ca6c8d70f10", "value": 30968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563806, "uuid": "b79e65ec-a225-44c8-af87-c53afb9dc7e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563806, "uuid": "eb5aa318-1a19-4193-a5ff-ce1dc25e6566", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db67dff-ce80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764571036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571036, "uuid": "cda3f0a1-372f-4774-9255-08d308ee8014", "comment": "Malware payload (Mirai)", "value": "b5d6ca05b679f75424f523f655de0472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571036, "uuid": "54770b0a-aaa0-4949-a4c4-64f23feb0208", "comment": "Malware payload (Mirai)", "value": "5569bf3426d939b9fd9f33f275e86f1e78faf9a157cc6aa803aef1f3df7db933", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571036, "uuid": "13347a06-2f5e-494f-a3ab-87ef2c8b5fd3", "comment": "Malware payload (Mirai)", "value": "a67439b75037e538604b6e248374a2d4bc49438e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571036, "uuid": "9936aa69-9638-4e69-bc1d-9e85549802f3", "comment": "Malware payload (Mirai)", "value": "8e0ebbc51cdf0be2769fe45b4103f326d7e151655429629ee94c74420048481f0d379e1cdf570a3de05cf0ca77cac44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571036, "uuid": "6bdb00b9-a737-4ebe-bbff-b924071f4e18", "value": "T15D13E021F296CF45C52DC13F60BF3A8B1A50FB1E9B0F96E099C42025A809F6B252C7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571036, "uuid": "74927ece-8473-467a-8437-59e448cac3b3", "value": "768:Fpf/8KshvtflEvvMYx/jXZTTRJfASEU1jRQ0meBh9wY/GzT3hxiHId6ZGQJnbcu0:j/yFfKMs/jNTRJfA01ljViTfAIUZGAnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571036, "uuid": "69baf2ba-b52b-492a-81cf-f61631a8c617", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571036, "uuid": "d8446e43-3deb-41d9-952d-6aa11d52e208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571036, "uuid": "f0d073c2-3488-42e5-887c-208cb9288f49", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b30f2c-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764600071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600071, "uuid": "ef85016b-6fe7-4f0b-8615-3645c613a428", "comment": "Malware payload (AsyncRAT)", "value": "91581aebe79da07ae333fbd897a0ed80", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600071, "uuid": "cbc3a59b-4b33-4d09-a0c5-03cc5e8a59d0", "comment": "Malware payload (AsyncRAT)", "value": "5659b4ea8582b110707f84728ceeb09d22e72c0f729a02d6d73dbf268b2397bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600071, "uuid": "b9138fb0-3874-4446-ba2b-4dba8e2ca0d7", "comment": "Malware payload (AsyncRAT)", "value": "84bde894d0d78bb67f8166057f96d28743f42d32", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600071, "uuid": "c0520195-f2a3-4fb8-9580-c73fe0d46356", "comment": "Malware payload (AsyncRAT)", "value": "c91a4f2d9df2f68151e2a2fdbe6d02eac9c736301780e104c9ca3b112f6670cdf95339ea531f323e954654bd0aab2f0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600071, "uuid": "1301aa0e-339b-43ae-8880-d7ff416eff78", "value": "T1D89402E85BA8CD13D8A15BB219F1E3B153B91E9EE016E6268FEECCDFB4197050D04760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600071, "uuid": "d9bb6825-f0e6-4369-aa30-d83a20c367e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600071, "uuid": "f96d2acb-4698-4bb2-a77c-e9ddbfb0b5fa", "value": "6144:v1Y2V1qjwZlh/wMWcBuJD+KndHxcKPROrhNrJsySgoAzBRrjHhU3:HHhp1uJasdHay8WFgPzi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764600071, "uuid": "0824665c-09b8-4318-a32e-fdb22bc1ec16", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764600071, "uuid": "17c7eb1f-3fcf-4dda-975a-e040e63b02e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600071, "uuid": "c085ef87-d91d-4138-9a67-090ed3b4e7cc", "value": "2026 Annual Leave Compliance Report.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f144549-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764620941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620941, "uuid": "57cf0343-dd5f-47bb-abf5-7fd2f4a84fa0", "comment": "Malware payload (LummaStealer)", "value": "a5a82d3d5a495ac8ba23256fd5b9b208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620941, "uuid": "6cabd72a-9958-4fd1-aeac-6802d8b940bd", "comment": "Malware payload (LummaStealer)", "value": "56d559cf3355f33a907466ef3e52db1c372662bfee959ec240e9a3a6c988728b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620941, "uuid": "f4b333f8-f6d3-4131-83c0-c993a03e44e6", "comment": "Malware payload (LummaStealer)", "value": "d630461d0302c5b36eb8a6f7bf57afc2d1288e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620941, "uuid": "efd67b61-9405-4019-bfdc-d296b2fdb7e6", "comment": "Malware payload (LummaStealer)", "value": "22a6a0df1b2224726a6e6ba6f8e5993f4083af8d6f37f26edfc80408e0570d5e147d99a5678970b71cd9dde5cf4293a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620941, "uuid": "9061dcf3-26e4-4600-b516-e3e614387a8d", "value": "T16246CFC4C2E441A8F4334379CE71B411DBB27CB91625B36A9B893308BF76661A53B3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620941, "uuid": "8dcb68f8-548f-4021-9ace-5cf7a5c712c0", "value": "316b9a6707c3c0b096d34154225ccb2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620941, "uuid": "db2b1d61-8c4b-4ae2-abe6-4ffc9de65d80", "value": "98304:SMuQVa8m0WQOEPjFbq+5CJDcduOuWjcKlbt+lkogmuI:f5KzOx54kkkguI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620941, "uuid": "693a79b4-e0a0-4232-a79d-2fa1347a49fe", "value": 5539344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620941, "uuid": "f59ae3e5-c636-49a7-b16d-81b980132620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620941, "uuid": "a6e9d0b2-aa36-495b-803d-91a01c372bc9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197b8aa4-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764608368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608368, "uuid": "2c738584-8f27-40d6-9671-2ade5fa2e094", "comment": "Malware payload (AgentTesla)", "value": "bba6f8f1185f163ac5cc8aef4903a6e4", "object_relation": "md5", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608368, "uuid": "b6d3dccf-9ece-4506-aa68-f3c54a08c9d5", "comment": "Malware payload (AgentTesla)", "value": "56e0cfc0fb789f7d8d7cef0b8497eef95563f46bb383d5f38061347657eaa445", "object_relation": "sha256", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608368, "uuid": "880f0329-5c1b-4f99-8567-b6bc2dc451dd", "comment": "Malware payload (AgentTesla)", "value": "354e6daed29ab2e19245da47a68859c29a6026b7", "object_relation": "sha1", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608368, "uuid": "c8e23a00-ef4a-46e4-ad21-ac5e45331e01", "comment": "Malware payload (AgentTesla)", "value": "e68a8531d3d08e3c0c84d8e2d5d0f3b7ffae78b7b5afffda7abfaf5d1127076994a4a4590fc5eab8186a6c798ddceb5c", "object_relation": "sha3-384", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608368, "uuid": "a5b68ef5-9629-472c-b79f-7bc9a0b1234f", "value": "T1DBE46C7603404366D2C867D0415BA91E55B6FA5634A82B89FFF22ABFEC14FD36C34263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608368, "uuid": "d3c49979-6540-4ef3-a8f3-35b54f8bc864", "value": "1536:raeZo+urYb6AmjK5EDpxsasasasSygut5cc3+CNrE7gnkvxLNwsnndr+hcxWOlVa:tOYb6FjK5EDpggW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608368, "uuid": "ff1efdc6-c130-4ffb-a726-a71da3b966c1", "value": 677484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608368, "uuid": "231d7e77-ea39-4245-8490-6d9ceb5b873b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608368, "uuid": "bd5e4fc1-40d0-486e-9b72-7b48652398e8", "value": "decrypted powershell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558ee224-ce4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764549199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549199, "uuid": "6f67838e-c038-43d9-b07f-5122726e0795", "comment": "Malware payload (Mirai)", "value": "5014ada9673ea785a4757cb1a34e1815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549199, "uuid": "1e6fdcbf-b09b-4aa9-98d6-ff316eff0685", "comment": "Malware payload (Mirai)", "value": "575af709ba5540a2819c82d51f75b78445c620b2536c977baf76e424a8a6bcf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549199, "uuid": "bb4e45ef-088f-4c97-a4d4-da92419464b5", "comment": "Malware payload (Mirai)", "value": "1973880a531f2fa51adbdad1e64444e9632c5ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549199, "uuid": "1fef8103-d4a1-4f38-a6a9-c67fe9fb3c9c", "comment": "Malware payload (Mirai)", "value": "21f74c129ae6292af4f622eb790f5c28b23348e1761d096cdecce3f57aa9f12514f7d06882f9454261ae94427679fe42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549199, "uuid": "68cda18f-b264-419f-aa8b-f40ed257c319", "value": "T10304E8066F520FBBD86FDD3702EA0A1139CCB81B25A53B757174E928F50A58B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549199, "uuid": "93d18439-ed7d-4fa1-ac88-08613100f399", "value": "3072:TAxwwUMU8YSMYewYzeBjYyxspUpJpQ0oTKX:TQwwUMU8YxYVYCBjPsurU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764549199, "uuid": "80720cf0-96d4-4f71-95b2-838eec3fc761", "value": 179764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764549199, "uuid": "6150bfee-12f2-416a-97bb-71171fde6cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549199, "uuid": "0490f1a4-5f6e-4735-9ebe-f3f9d814473d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8582f2c6-ce8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764577196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577196, "uuid": "8f645be6-0fb4-4cd0-9748-5e6c5cb4372e", "comment": "Malware payload (Mirai)", "value": "a52f1958c80fee4a140b669982f1a23d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577196, "uuid": "94b75c16-70e4-4411-a6ab-7d77c0bcf11f", "comment": "Malware payload (Mirai)", "value": "5772d09795dec681459e3131d93e80a3de434dc600047718264ab6b6a58f827f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577196, "uuid": "d20a6c34-4fb9-4764-8b33-980af8c9d37e", "comment": "Malware payload (Mirai)", "value": "9d3b6aed6b2834077c41875bfc0e3b5992f56217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577196, "uuid": "eb9a2128-c4c5-494c-9200-a56c3fbba2dd", "comment": "Malware payload (Mirai)", "value": "3ce073952fb33f36085f2a399ae18103467548d97b1563326d8ebba6c9cef906faa92104fb8fcc0d2e64674cd41062fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577196, "uuid": "47b5523e-2517-41e0-a075-1088a913dee2", "value": "T1A0D3CF31F424ACD2DC2005F534B996B80B54AFB007D21482EFFEE96E947BD8879AD271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577196, "uuid": "bfee038d-d909-47b3-8ff5-2e92a54e9813", "value": "3072:gUROkGl54lq6p7o9I8SyixKQBrquS5Ofp:gUROxlOw6p0l1QBrqupR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764577196, "uuid": "37715b4c-6ad2-4bf4-a659-bfba766d8198", "value": 131676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764577196, "uuid": "9ed3bd01-91c4-462d-854c-0a888571860d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577196, "uuid": "ced07bac-3cfc-4651-905e-f9d3e2b0526b", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd835c1-cec9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764602603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602603, "uuid": "5f122111-512b-45e7-be22-e37ac2d97006", "comment": "Malware payload", "value": "f4159ca7b5806b69d0cc3da2880de884", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602603, "uuid": "01e07e9e-c5dc-4960-a649-50528787254b", "comment": "Malware payload", "value": "57940c5eee8641e02f49d1122528665a0ddfbf5b6b0d4b910b5287e15542591d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602603, "uuid": "bfd6d3be-25f3-4873-bd47-67bc52c9b361", "comment": "Malware payload", "value": "a5093849ae1f52f7e7a2fa2d14f2324d4747dd63", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602603, "uuid": "a55afc13-acbf-4f0e-9e99-da85ef877b74", "comment": "Malware payload", "value": "0b53ef31d1981ee04bc6503db5e0cf478d4d660f5e1af2a615221676f50034f5390c254a5105479e78829afc24b44b76", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602603, "uuid": "3a59f445-612c-49ca-a44e-3d95272467f7", "value": "T1F5861203FF5AD19AC4F78A33CDA545754081AE5587C3A2472C5CB3BE247BAF08A5ABC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602603, "uuid": "582e84a7-23d1-485f-8ff4-084e15a57a3b", "value": "196608:+QK38he4trH0Z733yk2tzOl5Z9oGNKHGQokxXX:rIteUhgzUKGN2GQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602603, "uuid": "5b05fe8b-328c-4be7-9335-26f545186536", "value": 8032689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602603, "uuid": "509ace25-4657-4fac-b73f-e93285a535e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602603, "uuid": "ddf250aa-5a58-41f0-9858-1a1200d50352", "value": "57.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc8e5dd-cea1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585478, "uuid": "fde5c526-790e-4d42-be2b-2207af781a68", "comment": "Malware payload (Mirai)", "value": "d6829d1e4178508dc74e0dfc520723bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585478, "uuid": "19a828e2-9ac5-49a2-a4eb-5a7222c1cea1", "comment": "Malware payload (Mirai)", "value": "58a05c7c581576e5ff5b000871f2fde3bf21f8456b042a254b6dbcd891354f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585478, "uuid": "04860474-5f71-4bfa-bd70-9846bc1a4b18", "comment": "Malware payload (Mirai)", "value": "d74dea5201b7a69de64ead6212ffa85873e8719c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585478, "uuid": "ce04362b-b202-4131-b7fa-aa4c98292a8b", "comment": "Malware payload (Mirai)", "value": "b69ef1f17dfc8927329dc707853e946aba0f83de699cdf39d6dcc25be48bfbc1b909430783352bd37d8bb01ee3103c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585478, "uuid": "854ee5ef-8b76-4776-a314-53417667fbdb", "value": "T1C523F1BD161BEB78D67CD0BCE3A64E1B3033E4A1C7AB36135A00749DC9C6C4566A26A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585478, "uuid": "dff9d3b8-191b-4e88-ac69-5f45e7da5c8b", "value": "768:Fx/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg47cmkDrF2fOumDKw35QD54dcr/Hs3J:InoTBJKY6xeTsWWetc/AmKwBzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585478, "uuid": "7cb4e4af-e47a-4e4d-a22d-b351a149f4a9", "value": 47388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585478, "uuid": "ac6c1b38-fb00-4ca2-9945-b2cbc1e7cbd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585478, "uuid": "260ddb57-25f4-464b-8e0c-5f52d7f0cad0", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3594b6a3-cefa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623448, "uuid": "da417508-7aec-431f-9470-aea7b7cfe77b", "comment": "Malware payload", "value": "ddd2994acd25bde5ac32a03f1cf30b41", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623448, "uuid": "a1db8e77-b3cf-4e92-ae05-81f23fcd412f", "comment": "Malware payload", "value": "59312a8d6663c9a404d0b5aa96b70be3946592e5c5489366e04114b11a722fa1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623448, "uuid": "15dbaf90-215f-48da-b0c8-a1297b6eb14f", "comment": "Malware payload", "value": "9b90c62299d4bed2e0752e2e1fc777ac50308534", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623448, "uuid": "88f31944-3c49-4932-afa2-62ee858b1ca7", "comment": "Malware payload", "value": "271a0d2d2c12720c0402f7075be6cf65e446a44d6f990c817daa35af40e805b1b7fffa142b9709dd2a6d1b37cca9275f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623448, "uuid": "162613d8-f5c7-42bf-b87f-6ea0c4db9706", "value": "T157B6D0D713ED13E4E4B1C33E8A153101A5297D9D2722B6E42A8973157BF5B23863AFC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623448, "uuid": "175d074c-639a-4198-8086-2e6066e84fb5", "value": "1b051b8929edd297bd54b50b10a5f3bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623448, "uuid": "18544899-0fd4-4fed-aef9-bc22a4568c36", "value": "196608:xwenvZGBJPzcGsl7U37YPrxosYYCV9gQXfLvSKzOx5n3:xwOvCbkBU3KxosFCVCIWKzOx53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623448, "uuid": "5212f450-ca06-4712-a5e6-b916714fb740", "value": 10551848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623448, "uuid": "9d8431e7-1523-4a7d-8840-430622f06a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623448, "uuid": "febb52fd-38e7-4c17-a907-d9a6b191aec7", "value": "Renewable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8696a544-ce7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764570326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570326, "uuid": "02c3baaa-7910-4e6d-aba3-4f699b08fe06", "comment": "Malware payload (Mirai)", "value": "6b83fa21bba4bb6b3053384a3618f1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570326, "uuid": "0efa3d6a-ea2b-408a-be8f-f2832fb204fb", "comment": "Malware payload (Mirai)", "value": "5978bbd2e68375fc97e2517ecdab52905248718f1e5af622add6c223b4463c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570326, "uuid": "4b7a7480-0252-4ffc-b078-653b018f1062", "comment": "Malware payload (Mirai)", "value": "df1228a34c59d79f63f2b77eb2065f9729a62f4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570326, "uuid": "234d97dd-8523-4c5f-8bab-4cd1c13c7f06", "comment": "Malware payload (Mirai)", "value": "5b8aa121717c5bc755b76736c847939b9b522b20477ef5fc03dfd5a22377bd0e289841106a736e29c2eed169230ba518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570326, "uuid": "9724fd3b-9fbf-4797-8ba5-cd2e6e8a6d63", "value": "T1CA830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570326, "uuid": "4286000f-d137-4490-8ccb-e3ff80df87a3", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFOQOCHFmKgAHCe:EPmBcPJUqiBlV34OQOCt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764570326, "uuid": "4d1f9a3a-3c54-4af9-b40b-87c4bc17699b", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764570326, "uuid": "d2daebf8-02b2-45c7-b700-eded6826b282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570326, "uuid": "9bfa22f0-e066-461a-baea-b872302cb5ff", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368174cb-ce75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764566326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566326, "uuid": "4f03ac68-8943-44c2-9027-63f7eee6c972", "comment": "Malware payload (Mirai)", "value": "e3ca2cd1ffe1f7e33358268dfc04844d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566326, "uuid": "e4c9a497-b9b0-4d52-a5ed-11e82887be9d", "comment": "Malware payload (Mirai)", "value": "5a55252b06c4a154806c8e5cb08fe28a216bb1e21b9a921003ee4c593e7a9a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566326, "uuid": "e23ae8c6-9c71-49b1-8c03-90281a4ce9d1", "comment": "Malware payload (Mirai)", "value": "5ef093132d563ea96da508dbf68fb9130282d456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566326, "uuid": "5971aa6b-d9bf-4d7c-bc16-798d681e1036", "comment": "Malware payload (Mirai)", "value": "f82b03f5e4c85137f69fffe75f0761e9aa7d0b2fd2bdf341bae8e48f6375a83c0d1f736dc3a8eb127f4b16d855509ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566326, "uuid": "a37016eb-9502-48ce-8ce6-9b1094eafd7b", "value": "T16023F17C9D2E9417D80255FA4F2213512D8C0BA702C3D9E2E688D2DEDA8357D7E87ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566326, "uuid": "815c1627-263c-46c4-a7e3-294e5bd364ee", "value": "768:D+jm/igUe0HCLCO63QTxr4p8c5zQbP/sdY7vZciCjnn1hVT4jKxeHSxhHAcaiW2q:DFigU7M6q4mc50b867miynvVTaweHSNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764566326, "uuid": "e265a89f-4c4d-4b09-b961-9b821bb2d5f1", "value": 48704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764566326, "uuid": "e24f3291-f65e-4229-8420-aa724e63d16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566326, "uuid": "1b4b2f76-732e-4842-87ce-9e0d59bf050c", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3d21c8-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620886, "uuid": "46bd3cee-c2e3-4bee-90e8-89737febb8c6", "comment": "Malware payload", "value": "a18d2b06c4154e8b5c9a048f2e846fca", "object_relation": "md5", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620886, "uuid": "4bf5516d-09d6-4c22-bcd5-0d274f07c7b6", "comment": "Malware payload", "value": "5ceccb76120440b2a4f9d9c244125d1eefc621bb52c3544b6ec393474a50750f", "object_relation": "sha256", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620886, "uuid": "3e0070ca-f859-4d13-afb1-1794fa5a8c21", "comment": "Malware payload", "value": "b54458a6122f009b7398e1d18f1bb7db30c6e574", "object_relation": "sha1", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620886, "uuid": "a8261e9c-8a0f-4501-ab6a-b31046415ad2", "comment": "Malware payload", "value": "116f2fff65584ebd496240fb091bbacdb6dfc2b87ed8216ec3f29d4e0712c09f791567eefa1b658e253927c20ac7e46b", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620886, "uuid": "cc07915a-737b-46e9-81b7-2a56b0d104ac", "value": "T103D69D67B1A540E9D17BC27CC946DA16E6727C4503208ADF16E04E6B3E37FE48E3E621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620886, "uuid": "bdf4a91f-df4a-40bf-b5b0-e827380367dd", "value": "3334d90feb32aa7441a8da0ec5c0b704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620886, "uuid": "9b048d4c-c4c5-4fe0-811f-e67fe98da32b", "value": "98304:GKyHa+tfbkOdrKNYH3kV9u4K1C4INUSXcJMt8a08OX2kNoR7trAjGVxI6mY2XW6a:GFauIOdAYn4SC4q8adK612X1tYhYiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620886, "uuid": "362167b7-ec8c-4af6-9c46-5fe7598a9fc3", "value": 13368512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620886, "uuid": "3e0c2998-be07-4524-b5d0-c8c78293d427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620886, "uuid": "a4db7745-f822-4cc6-9ff4-4f665333aa62", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb848a9-ce9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764582366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582366, "uuid": "0d7e654e-a586-4244-a325-f205c9c43423", "comment": "Malware payload (Mirai)", "value": "5a28036897a92f9a76b96ee8e1863c21", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582366, "uuid": "414f99a9-e757-4832-966a-68325d489c3e", "comment": "Malware payload (Mirai)", "value": "5d7901558152f3963c723481fcd6c7180f9164bc51fcc9d2c0fbfc5f1033903e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582366, "uuid": "8b254999-b373-416c-8cda-d9c53fe98a04", "comment": "Malware payload (Mirai)", "value": "5b80cdbcc4b16d8bf8e399a674f75328422db645", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582366, "uuid": "adacfa2a-6136-458c-8ac3-e2433fffbfb4", "comment": "Malware payload (Mirai)", "value": "1569aa16b883791c3a5e23c07a4305b58c2c47ed219598cb08235a48a6abc5ccb80a8a619b95e9a92f42741f418ab05c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582366, "uuid": "a8729099-d505-4323-a99a-88e20106222b", "value": "T12F011BEE129441F956D4BE0BFA526D34F7066DCEA8C90EC8968F5C312ACD9083425F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582366, "uuid": "42e6c27e-e99a-43fe-83d2-e05d1f914e4b", "value": "12:z8oYZDD8oxHWNH8o3D8oEHWNH8ozzvD8ozzMHWNH8oRIjDD8oRIMHWNH8o0DD8oc:zpYZXpBWZpTpuWZpzz7pzzGWZpRkpRh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764582366, "uuid": "1a4ae767-bb2e-4768-83f3-f6bfccfb5b7f", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764582366, "uuid": "de1b2841-c2ec-4413-842f-6dbd092b0bc1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582366, "uuid": "2f4e5dd1-5f05-47ac-bb00-4a3bf05e5d40", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159a4c16-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621247, "uuid": "789351d1-fad6-4998-a731-01c0cff67328", "comment": "Malware payload", "value": "76bfd7ce921b064bcaefbcb1da353fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621247, "uuid": "4ff32e09-a58c-4faa-95eb-17f72a5acb2f", "comment": "Malware payload", "value": "5dddfd8af478caa5c53c98306ab9461980d355ef38a4158ce9157ddcda3dc30c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621247, "uuid": "9db8d1b1-7049-4135-ae83-409a0f04ce0d", "comment": "Malware payload", "value": "62896fa3af406e4ff4332e71f06fda821612ec9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621247, "uuid": "11f5c9ac-0fc4-4b2f-af07-e0b361920318", "comment": "Malware payload", "value": "63924986edac57435b3e1902a812df1f08402873cf13b4ff91b2780764d5976cf4b13955fb3b402e02f5ddcb6486d738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621247, "uuid": "8dea3d2f-aebf-4fdd-aae2-632e53fe5d35", "value": "T1648533FEB2176C3DD1D8682AB2D77C05708D36CDC2668B7B23860D5101E7DB66EA740A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621247, "uuid": "67ee5813-3394-49df-b843-45b05a0bb13e", "value": "49152:llQGLBOQQszVsyNCRQ/J0QNc3YO9AtfTg9/uOi8:llQGdOyzeyYfQ8Atryu38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621247, "uuid": "936702f5-7746-4d44-bfe8-e4b82640acb2", "value": 1732476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621247, "uuid": "b777ddf7-f8a6-47ae-9985-63338497ec55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621247, "uuid": "204ce9f2-2489-4bd9-bfed-5594aff57e54", "value": "amelia.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521c1445-cf0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764630797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630797, "uuid": "c67dad0f-3c17-4802-bfe2-d09555033baf", "comment": "Malware payload (Mirai)", "value": "25c9550baca3c06a88b076f11388674f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630797, "uuid": "c18c6261-70fc-4728-bf93-73eb208aa750", "comment": "Malware payload (Mirai)", "value": "5e9106535cf08cf26b46e4fcff1f1a743738129d545eaf84ca847d591640fc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630797, "uuid": "71294553-ff1c-414e-b3c7-6a13f0e24fbf", "comment": "Malware payload (Mirai)", "value": "a32d77f5cbbd684332813d51bb5195df56a28615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630797, "uuid": "e2f6ed4b-f139-4442-8fb9-0bf28dcc78de", "comment": "Malware payload (Mirai)", "value": "bcbc75fbda25ce97f3d6990f5daa01969043b81d7999558b007b61548f7edc2a0d89277cd49321ca99155190c0aee2ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630797, "uuid": "2ea9aa86-d548-40ad-9260-28333cf2a148", "value": "T1F0D3B509BF611EFBE8AFCC3709E81B4124CD593B25A87BB5B530D418B64A64F29D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630797, "uuid": "aa827e31-e3f7-4310-a88b-ce657893b93c", "value": "1536:clXBjd75pnN1W90dQMWTMmUnYgP0hsWv8RhGFwmvvZRtTIhV2dc8B49hXCj:SRjdpPdQMWTMX/sFfvvm4a9hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630797, "uuid": "4ce92dd3-7149-4048-820c-aff3afda3ee7", "value": 131076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630797, "uuid": "70736362-f097-4275-bd7f-9a47126e3456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630797, "uuid": "30d42b4e-3526-4958-a699-663f39d17e46", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bcdd07-cf07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764628998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628998, "uuid": "dc9c712a-3ea1-467b-89a2-796b079e5c1a", "comment": "Malware payload (Mirai)", "value": "a3ec10fe8a17a782e6052ffad4d17ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628998, "uuid": "de25caa5-04dc-4138-ba51-e08908246e59", "comment": "Malware payload (Mirai)", "value": "5f01d56c02baecb06761cfc686f312d8f105bf5ac9b03e012f7e8eb3f709e64f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628998, "uuid": "23f4115f-39a3-417f-ac9e-a913a97b5df7", "comment": "Malware payload (Mirai)", "value": "cb04f05ac878fc3494d592203beac4bf0bcdc32f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628998, "uuid": "c27e1ae5-55b6-4f9c-ad7c-238819642465", "comment": "Malware payload (Mirai)", "value": "7adc817bc87ac205131a45d2c9576e824733dcf036feeb220b86721b2c3a3c9fc045076789d1bc57db99967f944bd4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628998, "uuid": "c037500f-6d4a-4619-975b-949b68aa223e", "value": "T1FE531A82FCA2C96AC6C82376B66E259E3315B3E0D1CF3217CD199F2437C550F5C6AA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628998, "uuid": "23f5e419-e8dc-429e-9261-ebb3efb34449", "value": "1536:gPEpuJ5AA+hjBz+Ay96bHOPGC+sKFPzbO:gPEpuMAYif+sKFPzbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628998, "uuid": "a59ce2d9-4b05-4c72-af55-19ca94c7f4ee", "value": 64200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628998, "uuid": "804a3752-467f-4950-bda5-35f73a3f0280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628998, "uuid": "8935fd08-0ae6-4891-b5a2-075f8166ba57", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f58246-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764598194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598194, "uuid": "faa36311-3ea9-4b99-b6bc-1f94eeb3df7c", "comment": "Malware payload (Formbook)", "value": "e259de55de0fec5bf2ebe6232c49455f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598194, "uuid": "7ae03125-92e1-4ea6-a6a5-84ecf981f9f0", "comment": "Malware payload (Formbook)", "value": "5f266855a1787ed15b3256ffec3e391369cbade79468f188fed70eb24ef96488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598194, "uuid": "14e6b926-6762-40ca-9794-669d2beeeaba", "comment": "Malware payload (Formbook)", "value": "5545be7468ad48752182fede7fb48ef41067ce97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598194, "uuid": "5c98f64a-9942-44e5-b426-8b6db4cb1545", "comment": "Malware payload (Formbook)", "value": "d5a467c3f0df1a5f59a880e3395011532fb9466d41bc9353cf7a643016fa5cf860875dfdf363ce0295a3842ef2b75a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598194, "uuid": "1691e628-35cb-4bb1-ada7-7e9d2974bdbe", "value": "T1C845BF0273D1C062FFABA2734B56F6115ABC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598194, "uuid": "a5684750-f083-49b2-a45f-b679de14f43b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598194, "uuid": "3d53fd73-ac96-4e42-8725-7b169c0342f4", "value": "24576:a5EmXFtKaL4/oFe5T9yyXYfP1ijXdaF8zyXz0MTUyJ:aPVt/LZeJbInQRaF8AzPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598194, "uuid": "38f122d3-2df3-4b2f-bc03-4708e6583926", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598194, "uuid": "c431e95f-5ad5-431e-bbe0-d974b3ad8555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598194, "uuid": "bffd0660-efa6-42f0-a8ab-8ecd6079e11b", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b278495-ce6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563838, "uuid": "a5435ac7-b937-44da-ab68-2f3fc52a39a1", "comment": "Malware payload (Mirai)", "value": "5e635a8d5c1b99f550264d0d26d7deaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563838, "uuid": "cf141091-9c6b-4d67-96ec-7c83bca32f6b", "comment": "Malware payload (Mirai)", "value": "5f8b878ad9fe80bec4b9e1ab291e379c9587b7ed80dd5be66091ed8581f51dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563838, "uuid": "8a61a258-7440-415f-8320-dc429fd3f042", "comment": "Malware payload (Mirai)", "value": "861ac541a29317c332a628ad78979e9708fa4e5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563838, "uuid": "c6ce4e9d-c6b5-49c9-84e6-acb4c54f6b69", "comment": "Malware payload (Mirai)", "value": "282ebcec1a1c3bd429c0ff0f96841b7d6fda65cffa93d14510023d7c13413ac24da175d0e6291c978a36bb0ee30c2602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563838, "uuid": "e26df525-68fa-4793-bb8b-7b0d93c373fa", "value": "T104830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563838, "uuid": "3f1aa420-9a88-4ed1-9d99-1f94717b1554", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFOPOCHFmKgAHCe:EPmBcPJUqiBlV34OPOCt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563838, "uuid": "0d101284-8477-4dad-bb83-a45675f37f27", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563838, "uuid": "587d54af-4e26-44ac-a35e-04a80664fc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563838, "uuid": "6df9e29c-65a7-4273-a9ec-9c3e739bbf6c", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2938655b-ced2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764606247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606247, "uuid": "b79a0ee4-acda-4b07-8e1b-0469cf963730", "comment": "Malware payload", "value": "7815340dfb50b3a6901ea0206df70064", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606247, "uuid": "c836d50b-5cdd-4e8d-974f-26f953385c89", "comment": "Malware payload", "value": "5f98a51ad7a3040bcfb2a2e4299585ed00814a13ff418edf368d304f837e3a12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606247, "uuid": "999ad3a0-dc66-47a6-818f-2a20cd1daa97", "comment": "Malware payload", "value": "50076a1a789c5776b1fae605aa2b986dee415657", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606247, "uuid": "c0fcf952-7737-4ee4-9343-c9259158e04c", "comment": "Malware payload", "value": "ac5f6671e78a33f9ee20ef9bc3e95a504211889353eee899f355210f30b8f2c0cda981e4e20947f05edb5d227b78ff45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606247, "uuid": "5461958f-e018-4328-b65c-4900faf9fb6e", "value": "T1C00165DEB2B134720C85CE3461614E4C9434E2D936B34B2ADDF439FAC5DA600B237EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606247, "uuid": "9032d758-3ae3-46f6-bbf7-5e9a16f91eeb", "value": "12:ihqYfNIl5B0LKp+OFOjMOTtjWSOZ0tygXVn:jYfNI7YKp+IOjXT5Wlatygln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764606247, "uuid": "1edc6df3-44c8-4311-8941-52d842dc6c0e", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764606247, "uuid": "b01106c9-61bf-43f8-b196-e09f528252d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606247, "uuid": "bdf5e37b-d242-41e7-931f-ec18e39d2261", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06313558-cea1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764585143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585143, "uuid": "c8bf2f55-d200-41c9-9190-555c65960044", "comment": "Malware payload", "value": "53fcc7212d9c5840ef2478b26f6e1151", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585143, "uuid": "4c748a4f-c116-4855-9bbc-4d9b6f455147", "comment": "Malware payload", "value": "5ff7a6a6b9329ef9755919cc77dbb12738a47c5a68a0ba16437fffef55715d5b", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585143, "uuid": "885d2236-fa7e-4b2e-9053-f51e18e8a55a", "comment": "Malware payload", "value": "4c4d1519aba58dd6c96fef26ac4b6a2302ee0390", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585143, "uuid": "01f07853-45df-4410-a360-69b82ff6cfa1", "comment": "Malware payload", "value": "eaf7677331d07d5eec72a23c75c4e4795fa1c47e95d10b01770c18728b165573e101020efc94441bca62247ba4365500", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585143, "uuid": "e76d53cf-f3fa-4b57-9b54-1596ad5b823f", "value": "T1B0625DE122A10720C8641739C7D9E986B61BFB6061B8DE46302CAE3CE6D45903DFA4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585143, "uuid": "936a18be-4e7d-4537-929c-013688fcc0f1", "value": "192:PORG66ssskRsoQsxneQgwetC30+Yppp9JN7rfxdI:PORG66stsgQgwem0+Yrp9JRrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585143, "uuid": "883d454a-5485-4029-824e-fa7d281f567e", "value": 15455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585143, "uuid": "fde13680-ec60-4c1c-8eaf-a3390c92da6f", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585143, "uuid": "64379775-c508-43fc-8f76-3fc7c27c12c7", "value": "3_idiots.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7571a5-ceb5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764594125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594125, "uuid": "4cc3eb23-6078-493f-86b0-bcba5bde9f46", "comment": "Malware payload (Mirai)", "value": "993ee445b8285c8763ca1d73b9468ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594125, "uuid": "4495c618-05b9-4cd4-8836-9ea961793820", "comment": "Malware payload (Mirai)", "value": "612c2debc0c2665204d8c10423cd9ac2a8026903b233b6b49c596e60ec62ba45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594125, "uuid": "b8b890c8-8f74-432a-a169-51214731c4d2", "comment": "Malware payload (Mirai)", "value": "7d55b23b5b2a7b6d457a28991194bced8bd4e2db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594125, "uuid": "0b58f378-4996-40f2-9d2b-21431272c3a7", "comment": "Malware payload (Mirai)", "value": "99a343992dcf5ade9f10b6f4f6804e825eb9dcc0c31bca1aaa335d4003b894cef53780904b50e41e298496f261324dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594125, "uuid": "5b757103-c526-449f-9977-155470be424a", "value": "T15DE43945BC809B61C6D13AB6F76E82D8731707B9D3EA71059E148B343BDB96A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594125, "uuid": "d52b8195-8b3a-46ac-9688-63658a740fc6", "value": "12288:oBhYjd+Z+w+Ivh2U9ATk4vVKcJvYHUn48OS8s11ZeEB6XMvaRQsg/6iW/O7q9bQI:o2d+Z+w+IrSEEANO7ACS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594125, "uuid": "5f7168a2-6a03-4e4b-851f-49f48f4244ef", "value": 665140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594125, "uuid": "c2187644-b5e6-484d-92bc-927e114c9d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594125, "uuid": "2138e26c-cf0b-49be-9fd0-75296a703a3e", "value": "sync.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f39dd94-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764599922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599922, "uuid": "a2f0d262-2675-4dc7-8cdb-4e56a2141a9d", "comment": "Malware payload (Formbook)", "value": "196f14d6790f8b90f236e05d6585cd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599922, "uuid": "abcece84-3cbb-47b6-9c60-b8400e6e713e", "comment": "Malware payload (Formbook)", "value": "6137cdf31d67be2f89e6875deaab29e1c84a72caf9108558782d141d2ca98963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599922, "uuid": "cb7fd065-5272-4cf4-91e5-51ab46071017", "comment": "Malware payload (Formbook)", "value": "61b583a2d621ef61d15198db6d52acf6aa02f25e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599922, "uuid": "ca6f98fb-72a8-43c7-b8c7-13a08f86d6a1", "comment": "Malware payload (Formbook)", "value": "65589ac466c2007d82280f3d4354187cbd37c2683e6e7e5d352b817f5670c61886a12bc2b794ad835a29f532f64089d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599922, "uuid": "574c820a-576e-464a-a5fa-17624c936b85", "value": "T121D57C07A39C0AE5C666D63C8A658632D67CBC4003E5978B1659FB0E1FF3B904E7AF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599922, "uuid": "6c5e09bb-a0b2-4cbf-af9f-39a9800d0da7", "value": "2270fd0b73536a5caf4923a42679469c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599922, "uuid": "3beba782-f45e-4056-bbae-73c750828571", "value": "49152:qrDb1rb8uqEjNmmd/b6Cyb1ABN7zMnvKB+zm2BsB:CrQEjTavKBsm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599922, "uuid": "e774eb4c-0b0a-473f-b1d8-708f5dff8fcb", "value": 2825728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599922, "uuid": "531cc552-db40-4774-8097-5370f58cc454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599922, "uuid": "4ed801da-282e-4663-ae8a-1ad8b6b96a6d", "value": "SC8017830264swift-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f27e87e-cec2-11f0-a129-42010a9c0007", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1764599466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599466, "uuid": "7ce30b96-1493-439f-b04f-55f965fb5f5c", "comment": "Malware payload (AveMariaRAT)", "value": "43faa5f5ab545ce6be01d4d3cf8642d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599466, "uuid": "40b8de06-e4d7-4c56-bf05-85111d624d48", "comment": "Malware payload (AveMariaRAT)", "value": "61477ea2220941345454e63fac8daf508fb97643c73d82d5dd925a5cd472df8b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599466, "uuid": "29295702-39ec-4387-b967-028eec98e009", "comment": "Malware payload (AveMariaRAT)", "value": "4b904e403503340668a39be1d20e00055ffc98da", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599466, "uuid": "3c7a6f87-7b33-4c9f-9f4c-0c670c691b75", "comment": "Malware payload (AveMariaRAT)", "value": "0a19f7a5dda5025c289a5d41ad91c60ed5b083af7c45396c87815eae48eecb78cdca2bb7e0ecda38cceeb3296ce23fb7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599466, "uuid": "c93f296b-02fe-475f-b7fb-44ca67771003", "value": "T1C5F49D62B9C0E1B2D1A1203CE1A67BF60D3A5D68CB1095C7DA843D75B9306F06E3B79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599466, "uuid": "5306688b-288e-4759-b266-b510008eba43", "value": "9fd837541bdace2dd9acbce492a0a8a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599466, "uuid": "9a87d3cb-7318-491e-8e84-e5aa2d5aef20", "value": "12288:3S/ihz4tgY5PBBWFDvn7HWDDjWKgRaRM+7Q91R3yZf6b1rd8BVZp:3xYtTWFDiGKg4Rz0XRiZfY1rdwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599466, "uuid": "7a6a9049-c151-41da-80b9-1612cbd042d2", "value": 733792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599466, "uuid": "a7879664-e37c-436f-879c-3a3cf43ca302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599466, "uuid": "b4b0ab56-4e10-48a8-bbf2-8bb572eea844", "value": "Alboros.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa84e3e-cea9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588729, "uuid": "afa7817b-5d6e-4c0e-b5f2-5b4162cfcea0", "comment": "Malware payload (Mirai)", "value": "bcc6d4f2e421ce15a6a3f86fe77cdd64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588729, "uuid": "e5ae8572-cdd0-4d13-af4d-1909878b0a07", "comment": "Malware payload (Mirai)", "value": "61860825478ae40b130a5cf31208864cb63fbbb3ae525bc92bac19241f83920f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588729, "uuid": "d4617d03-45bb-4b8f-b3b5-12db802c6031", "comment": "Malware payload (Mirai)", "value": "6b8d132933274c8efc3a91bd1eb57a01d9073bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588729, "uuid": "cfad3b14-48fe-4e79-a93d-2b4488092e8a", "comment": "Malware payload (Mirai)", "value": "ec4d392d4cafb49a9246cd41c1b65ea2f8124d0788998cec2c80d15f943be60bcdd8e49ba0ee5ea42ba498539ec2e3a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588729, "uuid": "2f002726-b9aa-4063-ab18-5e4f22f26d33", "value": "T1EBB37D21B4381E27C4E1947B22F74766F1F657D920A8CA1F7E720E8EFF256502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588729, "uuid": "b5cb3a8a-140c-43fc-ae32-7b3497fcb8ba", "value": "1536:ZHIO8eULmvhQRTn7bn98OTgebNc9hf6aC9g+Zt/YN+XFs6HtaD3Ym5rYM5J5tAJq:lIEroMHf6BsN+Wow7YO8Rbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588729, "uuid": "c8340971-b06d-48e8-8cb2-d0301784cf0d", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588729, "uuid": "7720fb92-adba-4599-ac98-64b7b675c569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588729, "uuid": "957da2a9-4717-4ae1-a70b-9c893a6e7038", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d629a2-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1764569198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569198, "uuid": "d492f29c-0d6d-411e-a941-cdd4ac55b83a", "comment": "Malware payload (HijackLoader)", "value": "9180f4c786d6df34e8783be7485d57bf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569198, "uuid": "ee906bf2-d884-4ed8-a8b6-4ad89628d82f", "comment": "Malware payload (HijackLoader)", "value": "6260f900197592b6d88f500c58e3bb03cc98606ac5f4f5c33b2953c2b3aa2309", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569198, "uuid": "e50a4da5-9f4e-4b5f-a178-3dd0800b2e5e", "comment": "Malware payload (HijackLoader)", "value": "31631d7efba4fcb4ad9fd604391f4831c8980c73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569198, "uuid": "afbcc19c-10e0-4d22-bd26-9519a794e9a5", "comment": "Malware payload (HijackLoader)", "value": "62ffd24525d4a8606f8f2ac2a9bbe62bd3b174c3ede7482819269195afaf29bb07b25d31771de91cf2ce97e5c54d9e0d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569198, "uuid": "01bfce0d-bc59-4f29-9074-44ca779c3b33", "value": "T1C07633019BC31132F9F22A719999C4020E1B37B939FCA8A52EB8D55D09FC6C7C9F4667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569198, "uuid": "887aa6bb-052e-407e-8405-9d9e8e38eecb", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569198, "uuid": "5a1713ba-60fe-4c06-bd04-bba5513cf19c", "value": "196608:U7b2AjENGcqXRHaP24e38PnqP++Ri9myd:Mb2+EpWRHI2a++Ci9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569198, "uuid": "18822200-3a0a-40e2-b8a1-87aaf6e889e7", "value": 7293563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569198, "uuid": "2b17510f-1b22-461d-9b3a-244d7fe70b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569198, "uuid": "f28fb41b-97c2-41a9-9a39-9f17d4e3295a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70e84c3-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764569200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569200, "uuid": "8a52a841-a1e2-4370-935e-550c19bab1ab", "comment": "Malware payload", "value": "1cef40a4f46dba65663f47fd89a3b643", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569200, "uuid": "01a326b8-34d7-48b0-9825-5b9217d5e0ec", "comment": "Malware payload", "value": "629630325b82ea7563853fad005a09a2e44113f24ea578b14bf0a9791c1333cc", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569200, "uuid": "c573976c-4f97-4a42-b886-04acf6b86a10", "comment": "Malware payload", "value": "cc77250df5ea5e1451ca4c9d6661261ce60e328d", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569200, "uuid": "820a33be-3612-48eb-8084-15368abc7aa7", "comment": "Malware payload", "value": "2b0c96e140adefa0c8ad84e716707faab5f531f2eb5fa16c33775f2c310e18607cb134cfa74ee4e8843ced982cc9236c", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569200, "uuid": "367c6415-4755-4874-b7d2-7d70da50ed22", "value": "T18F01D8AED1DC9D5006B5C685B1BC824DC451404391B46BD1F34E4D336F66ACD789320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569200, "uuid": "df761c71-61b0-4652-a4a4-4edce9157225", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GEjICkV9G0slkV9G0BA71/PFGZhG+E6:FH8j/wWi2jzyIIpV9/sSV9/01/PFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569200, "uuid": "73c50a2a-9766-45ed-8008-18b8a47aeea1", "value": 747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569200, "uuid": "12b8d24f-355a-4639-923a-5a7709962884", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569200, "uuid": "95507034-6190-4aae-9a3a-c22dff478fac", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd1cf93-cea3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586226, "uuid": "6e1037bc-8a45-4a8f-be05-4db61aac7a4b", "comment": "Malware payload (Mirai)", "value": "f16ad811ff7d2f12dee85b63ec02942c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586226, "uuid": "43facd37-a497-4be8-bb91-3cf196be451e", "comment": "Malware payload (Mirai)", "value": "62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586226, "uuid": "b5e2b8d8-a301-42e3-a50d-73408d1e87e0", "comment": "Malware payload (Mirai)", "value": "1a9ce6b9e995904a2a35bc4c8e806152f491301e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586226, "uuid": "a50cc1fc-fcdc-432d-980c-09581539a019", "comment": "Malware payload (Mirai)", "value": "657fcc3bc9fd5a8bddd14d7e34304fd64e3c4b95df438992e024f2df603a3932a0185e356724e6f9febf5e083c3a4d0b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586226, "uuid": "e1a53b1b-28a2-4b5c-815e-89b5a57cdd03", "value": "T1B2513B8E056C3D2BF719DF26B3B3AD1A137447E450A7CF9DAFA016269C09B5060CF522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586226, "uuid": "f7a259b8-f85c-4984-9015-1180382c3cfd", "value": "24:Ymfbj8teTYes1cxXg1D3OStNIyE/ymGlAKs/AmyJxlrloExhymeP6o4cw8muLWNm:VP8tos1kWlA9Ahx5hhOP6o7sB5+CHOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586226, "uuid": "92dd5c16-c23f-4b9b-beb6-cce980ccbab8", "value": 2795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586226, "uuid": "581871a8-ae94-40c5-b0dc-b929b9fb0976", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586226, "uuid": "ef665117-37b6-4eed-bd77-b92d77a2669e", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1861d-ce7f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764570769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570769, "uuid": "0dc78ec4-ef2f-4a24-b9f9-a62de28d7b87", "comment": "Malware payload (Mirai)", "value": "4a0fbb71818edb6170487913efe12df2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570769, "uuid": "d2e4bae3-9ea9-4bb9-8d4b-cf318cffa15f", "comment": "Malware payload (Mirai)", "value": "63ae3f82511189966dd3ba511a33a8d2249f8156eadc046ef95190b936b67554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570769, "uuid": "e4356eef-2b79-405b-848d-3b8aae7aff78", "comment": "Malware payload (Mirai)", "value": "6373b04ceb995e852d9998a80972fe1ed86f9769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570769, "uuid": "76395c4c-00a9-451f-9654-32a818bcb39f", "comment": "Malware payload (Mirai)", "value": "98b5b14506a4275cbecbcae56c7ecfce5aa4ccc868d3cfa8dd87edd686a8c5fdd215e3f187f3e8d5354a0d55521a00c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570769, "uuid": "b9b5fc32-fd9e-4995-a9ea-4316fa614085", "value": "T10AC33ADAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570769, "uuid": "faebb4dd-af8a-48d6-9bc2-4e7a3aeb4be2", "value": "1536:NVI1MQBlUwbswLQ657zSwISXqDdkZjPyVbhHWYpL3fPu8lgxFkGOEVK5Kx5vjLvJ:N7wLf5ESykpq2sL3XunXVhxNAp47Ztmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764570769, "uuid": "d7611af7-b79f-439d-8973-1853c133bf54", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764570769, "uuid": "db9e4ad7-166e-4892-9534-e0cfb60bc6bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570769, "uuid": "c3fea7ca-2697-4f1b-9082-2a766648e9db", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705d4f10-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547526, "uuid": "94aa11a2-6694-47dc-91b4-f6d9a765b998", "comment": "Malware payload (Mirai)", "value": "aab391433dcbba1f623875e9ac9293be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547526, "uuid": "0223c518-2341-4bce-a8be-6e17bccde147", "comment": "Malware payload (Mirai)", "value": "64b9dbb37254114766132e5bb2c2f94ba031ab6e7f88d0465d390f4e7e7bfc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547526, "uuid": "e5742255-a7e4-41c3-871e-4df71b81bf1b", "comment": "Malware payload (Mirai)", "value": "d085aa3a30b8b8d1b6eb73aa76464688ef4a5e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547526, "uuid": "cc9942ab-121d-44bc-beb3-f584fb9bcce2", "comment": "Malware payload (Mirai)", "value": "04440741daebd2e62d8bf17ef266e0b63aa91fcd8ecffa420521dc314cb58e3d7be89d1ec772b94c1eac6e3ea4176b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547526, "uuid": "e6335e1f-6971-4ba1-86f7-ab25308726f9", "value": "T153B3394273180F57C19709B02E3F17F687BEE5E121E0BA89650EDB5A8675E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547526, "uuid": "8605bdf3-492b-4b0c-89b4-b7f9874b06e8", "value": "1536:gHXylSpMEscMYse9k1Ii8ptKLvYnAXVKDY9r+JuUqtBxHV/TE:8Xygpusk1r0lW9+uVTTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547526, "uuid": "47286113-faa3-46ff-87d2-acdf348bf340", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547526, "uuid": "099c0ab7-244d-4514-a5df-301024f6f6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547526, "uuid": "ba1dc545-f906-4015-92dc-f87b5e4a0b82", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb7f8cd-cea9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588590, "uuid": "06a98bd8-94cd-4c44-902c-5b9608006eeb", "comment": "Malware payload (Mirai)", "value": "2c9d209ec593b7add03a697b588fa46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588590, "uuid": "54d0c03b-6a20-41a2-90ff-60f7f4a6a1c3", "comment": "Malware payload (Mirai)", "value": "659addfe6384773380cb43283ffc71814c52645cc38505a5b42601138bb156f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588590, "uuid": "6beaf995-4dc0-4340-8351-6843e7adec3b", "comment": "Malware payload (Mirai)", "value": "664995ea83cdf545dd99c267088b6637ae86ba03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588590, "uuid": "896a231c-17a2-4b66-89e8-636c8bfd3979", "comment": "Malware payload (Mirai)", "value": "7bf72fb2d2f0cba000a0553d915606b45910476f18e2dec2cbdcaa8fc76cc04d6a8ce4d26a7e3a94bae7d77357ccdc96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588590, "uuid": "5b4fea6c-eff4-4c47-8232-1dceaff853d5", "value": "T117C33ADAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588590, "uuid": "aaaa5e0e-555e-40fb-a767-50d9bf28a18c", "value": "1536:NVI1MQBlUwbswLQ657zSwISXqYdkZjPyVbhHWYpL3fPu8lgxFkGOEVK5Kx5vjLv+:N7wLf5ES7kpq2sL3XunXVhxNAp47Zt4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588590, "uuid": "c1ed1759-746a-4ce9-bf11-a8810586732f", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588590, "uuid": "6e3e5697-b157-4f57-a326-697289992f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588590, "uuid": "cff14a54-590c-4a1b-865f-841a09d1b497", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceaf379-ce4b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764548218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548218, "uuid": "aa483c77-49ed-4d9b-943d-671730b1c528", "comment": "Malware payload (Mirai)", "value": "4d1fcb70e09a72a19fa87e6cb5c3b0da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548218, "uuid": "5f87bfb2-7552-4a5b-a858-2b75a1b6058f", "comment": "Malware payload (Mirai)", "value": "662cb3f68599553021643f28a830300a3abb6b8b977225b834e93282b5f38a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548218, "uuid": "4df2ba16-d78e-47ff-b1bd-2c222586455b", "comment": "Malware payload (Mirai)", "value": "46165ebbebbfc68803a40bd6ad9ea6f1525ea7a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548218, "uuid": "cec95da9-1ebc-4a44-8d82-9e07f4f83ef8", "comment": "Malware payload (Mirai)", "value": "d815ff3279252e30fd24e7a4eddd0d796d88ca52c6f1700d5c6c23fb74dab36630dccb2c192c85b22bcdc8406211b6e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548218, "uuid": "00fb2458-7ae7-4336-a055-c0a1618005c9", "value": "T16BB37D21B4381E27C4E1987B22F74766F1F657D920A8CA1F7E720E8EFF152502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548218, "uuid": "8fa35358-494b-4638-88bb-f1c0e4e5d006", "value": "1536:nlfh5LXDKjWRchdzwErYZkSaNMCW24xsrEJsIn+rcQr/tSTYm5B4chJRtfkz6k:PRjmMCWVn+JbQTYOaGlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764548218, "uuid": "8c2949b4-a62a-464f-9430-fb5487e75a57", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764548218, "uuid": "58fd0836-e04b-49c1-8c98-a4e3829dfbb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548218, "uuid": "d261c6e1-34f3-4317-8171-a5608112a5a8", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f0eefd-ceda-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764609698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609698, "uuid": "fe94a2a3-b129-4deb-a43a-074fe43e1ea3", "comment": "Malware payload (Mirai)", "value": "54d8ce8a4a802a91daa99f61ace55379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609698, "uuid": "7b25550e-60f8-42ee-a4d7-28f6640305b3", "comment": "Malware payload (Mirai)", "value": "66d7553a8c4b3fb033a5e805d341a299231fd9489a4fd2e1577a04a851a7fcc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609698, "uuid": "de27839f-2f72-46e8-b72f-c0439083e221", "comment": "Malware payload (Mirai)", "value": "5257ab16176e5f0fa1d5af5ef2a0bcc46123333a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609698, "uuid": "6825a3c0-e9dd-4ca3-9f7a-b91523dcbd22", "comment": "Malware payload (Mirai)", "value": "b806fae80701fd792f1b3d3d239231b6b11426c6a2e30dab284437be9a04f22fcd512384407509ea13bc34f9ca83c606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609698, "uuid": "458aaca4-9c8b-445e-b221-8b6c26ae8445", "value": "T1F7C4394ABC908F51CAD53ABAFB5E42A8735747B9D3EA71069D140B3437CB85A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609698, "uuid": "d33f6bae-0e8a-4c85-9192-9e89977d02a5", "value": "12288:8HaUKUAZZ1p7T0789ATkk4VzcJuz1ix48fYZSCfGKq4KGa8O9t6RTmPcl7N3/QpE:85KUAZZ1p70YwLrvy7N3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764609698, "uuid": "2e90998d-28a9-4c73-a219-d1b880d3fd5f", "value": 558636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764609698, "uuid": "62f68325-80eb-4ddb-8329-a4d397f669c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609698, "uuid": "531bace0-52a6-4d0d-9503-a6186817fc7a", "value": "sync.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71509fcb-ce94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764579740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579740, "uuid": "20b854d7-93d9-4bc1-84ac-2bed9c7e6f4f", "comment": "Malware payload (Mirai)", "value": "bdd1ef2ff1c19c419397a643a8a1e81f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579740, "uuid": "6f2764ee-6fea-43a8-b109-53189280ed81", "comment": "Malware payload (Mirai)", "value": "67a9d54091c8a47789ef47cd4da32bb6426072d302eee21895b6d4ae7b4d6008", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579740, "uuid": "ea079ab0-be9e-4bfb-b765-1877abe8ee29", "comment": "Malware payload (Mirai)", "value": "2a3c8430daa2355585ee0f0d8fce89cfb1b13d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579740, "uuid": "0557200c-eeba-4bdc-afeb-86604ed92b89", "comment": "Malware payload (Mirai)", "value": "c5f50ed41c57f3a2d8599fea0dcd879b1d85a22239e5f1cebae460b92087abdcfcf6e5a0858d5fc20ee29388b312fea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579740, "uuid": "1b450b66-cbb9-432c-9441-f4be2da0e0bc", "value": "T15623F182119F2268D72F20728CAEEF0E1C74B42DC692E99F1548607ABDD6E5C1D18B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579740, "uuid": "f6fea331-8dc5-4e20-9600-bbb1c513de45", "value": "768:zZ+A1ENhFI6vR8IxA5w7ZmfDoMxAiiaaWbIxRRutLJYHemUPIQrt5nbcuyD7UHQW:F+A1OR8Ixbm8+SxyLJnmUPTnouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764579740, "uuid": "c55d8778-c66a-4e12-8e2e-61b5a30bfc68", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764579740, "uuid": "b6d1a6c5-9153-40f5-a791-42c639f7b67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579740, "uuid": "afd6c223-597f-460e-ac63-c6f98fa4fa61", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bdab1f-cf05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764628258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628258, "uuid": "d4bf2881-d40f-4362-b5fb-52b0c413fe67", "comment": "Malware payload (Mirai)", "value": "5a259223dd8c7e42b2d941386e22920e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628258, "uuid": "66ebb996-81ef-487e-9249-81183a2c66c3", "comment": "Malware payload (Mirai)", "value": "67b8eea5849fede0ec506f689f875d412c8585f5ee3cf787c6b3dfc7be91b739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628258, "uuid": "d5fcf27d-b16d-4ad5-8612-06edc45a79cd", "comment": "Malware payload (Mirai)", "value": "293fb0afb06e6cff7f141bf5ca5a5926be13dbac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628258, "uuid": "b4ca9961-56d3-4e1a-81ee-02aeab7c0966", "comment": "Malware payload (Mirai)", "value": "13ab1d04e1d896228c2feac8c8fd226c580e50fd659e03461ddad633c194498cf5be9da4f1dd528d7e2e68043fc9720c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628258, "uuid": "0609b9da-77b9-418a-8318-4b0c3647fcf0", "value": "T1C713F2022D2DE463D7F54273F92F5FCF351F0674F2BC91EED128096882E98892659382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628258, "uuid": "18648f9a-6803-4d6a-84b6-edaaa6e4d0da", "value": "768:1iSks93xJPmLysjncKjmNiiitMXo9vx4WRIiRJ8QNs3Uozs:1T3uL9fHiUMX3iRJBQzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628258, "uuid": "2b1f232b-d5ec-40f4-96ab-f63c6eb874d8", "value": 42988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628258, "uuid": "4d5ffa5c-9abe-4862-a651-cbd90b7e9367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628258, "uuid": "7add4a66-ee0b-4197-a58d-f5b8978019fe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0756a5-ce6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563442, "uuid": "25746e25-3f36-4f99-ab3e-39644f1ac6ad", "comment": "Malware payload (Mirai)", "value": "839eb9b5ab1c192ed082af10e12b3b8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563442, "uuid": "e095949d-4893-43d5-be54-f327bb0ad7ec", "comment": "Malware payload (Mirai)", "value": "681c5d6a4717468c489f5d9916cde1d6c65cc6b39e51f20442e09cb168d912cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563442, "uuid": "cd68a2a0-59b2-4852-8a48-1b36c4b524db", "comment": "Malware payload (Mirai)", "value": "568abedafc02632d1aed384b6518bad9be4d442a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563442, "uuid": "123d5469-e252-400a-975e-b4648cf1e527", "comment": "Malware payload (Mirai)", "value": "1f479d95190457303280e8a9b5c3c26a992fe29b446bdef8378ab332a47a51e84dd909af03535a7d61960c317aae49a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563442, "uuid": "bddbfd6b-649e-42fa-bbf0-c47d14f97f17", "value": "T184B339C0FA47D4F5DC1641306177E73B9A32F1B9123ADA87E7A49B327C92B41980A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563442, "uuid": "5f4ffe4a-8e40-4eae-bda1-410a60f8e96a", "value": "3072:5Pu05EjWVIELFZqNjz3anrz68GWBEu0Yr9bfFPw41:VueEyVIufqNjzanrO8v9Zw41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563442, "uuid": "da24c427-4a01-4b9f-b71d-bd5699c77b3a", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563442, "uuid": "d50bf5cc-4fb6-493d-83f2-f010a7bde796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563442, "uuid": "5b1b1817-69f8-4904-9434-99e4bad27b3b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d187a2f7-ced6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764608248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608248, "uuid": "230339cc-17ff-41d1-bb6a-542d24b6f769", "comment": "Malware payload", "value": "a848d737c34fc0a40696347089efa6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608248, "uuid": "497a2d12-6801-4b40-977d-e23d234736ee", "comment": "Malware payload", "value": "68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608248, "uuid": "ac2cb4ab-cb3d-48c6-8f3a-8b0caebba327", "comment": "Malware payload", "value": "0735cd36b4f17312b8ad79d06f0cd9cfafa5aa5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608248, "uuid": "fa404a41-3c8f-44d3-a5d9-7f13d34d1ad4", "comment": "Malware payload", "value": "93d3252e0f1e17bf3b3f5b18663c574f0657b0b0cf6b734b3133f379fd2d2846e4081aae1bd8175970d91432c7e4e3c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608248, "uuid": "1ffa6bcc-0dcd-42e7-aa8c-93d69779ae2e", "value": "T136451223699CEB03F49013F11D77DB7027B62E4DE061E29F4AEA6CCB781531658C936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608248, "uuid": "8c8be78c-cc79-42bc-a8ea-a224149e785c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608248, "uuid": "82500170-faca-42e4-8802-d2402c166a01", "value": "24576:ZDC6EZ2f1j42HTb94t3KsM58SqMhbjVUYoSSMVgf/TV+L:Zf19dI3K4SqMBjtSQs/TgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608248, "uuid": "76475d76-5b24-415c-aec5-b26c73061464", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608248, "uuid": "1811a736-631c-4124-920c-0286c90b9161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608248, "uuid": "e610b838-713a-469f-bbcf-8275968f09eb", "value": "comprobante-swift.0078-887.001_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04c96bd-cf0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764631036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631036, "uuid": "38334273-08b5-48c4-ba7f-e87121907b10", "comment": "Malware payload (Mirai)", "value": "64984387e24390262e913ab101011ed0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631036, "uuid": "d786ebd3-351a-4dbd-acab-64a8e5b8d45a", "comment": "Malware payload (Mirai)", "value": "684a9fe4d06535c565e2a8a523abb7407031c75d15429fff1917c27817c99ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631036, "uuid": "4af39b3f-114a-4eba-bde3-86751d5af602", "comment": "Malware payload (Mirai)", "value": "544fade86b89c427b054b0dd84b086e0ac3a52e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631036, "uuid": "56e850ee-46ce-4263-a516-a98f527d47ef", "comment": "Malware payload (Mirai)", "value": "abbb0d10b93f8c7253d19e31c6a1d426748d32995116201333fa8a7903afe70b943e4d77e29b060e0611b97bad7926a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631036, "uuid": "18c27064-37be-40bf-98e8-cca879fb1bee", "value": "T104935B0778D084FEC9AAD03847BF7537D421F0AE1239B15B1BC8FD262D8EE601B69566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631036, "uuid": "64c7643f-e0b3-45c7-906e-f64a9777af11", "value": "1536:5cuoIXpqn8Me1WJ+luv0ar9BfcQoVQbwU8ca9CCvnfw5:5cuogqn83IdfaVQbu9CCvfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764631036, "uuid": "b89957e4-97a4-4d94-acc2-91eb23bcc952", "value": 96464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764631036, "uuid": "14f4334d-5d6a-4095-af30-921710add9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631036, "uuid": "926312f6-86d8-4e4f-bc9b-498b474f83f0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce219d6e-cec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764598793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598793, "uuid": "b0f351ef-7204-4cc7-8e2d-b99ef3947fb6", "comment": "Malware payload", "value": "4e9b99500f2937542eb6ecb0513ee6ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598793, "uuid": "67d5ff0f-1432-49ef-877b-3334ea09dcbc", "comment": "Malware payload", "value": "68e5fb92a7d7d182306a025010c77ae2cd89c39031cced13f9686a9f34671041", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598793, "uuid": "bce88765-1573-4cb6-94ef-6e26c79048f1", "comment": "Malware payload", "value": "109729f99d20f4876c865f8342a9a4d486440a6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598793, "uuid": "428b2f8d-84d3-4996-8531-912be50eadbb", "comment": "Malware payload", "value": "f64530fb7fbffa1b0ca4d45b8888b6e3bbad9de58a84fb238e80081a63289b9a767cadaef1cc3fce913fd321f087cb57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598793, "uuid": "2a5fb2c0-71bd-47c7-b128-76881175628c", "value": "T12F858E83FE4254E2EACA01F410AB57B91D361207972489E7E2D06DB899326D37E3F74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598793, "uuid": "9ed82026-8653-4a11-bf70-5c81d3352bcd", "value": "443197698c60615f7de280c35301f334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598793, "uuid": "2fea0798-09cd-44e2-9a5a-dd7bb357db49", "value": "24576:f1n5zZGFaPhUUAPnkl/7YGsQJJ7jVrn4mLy743e0GAQcGfxh+Z0+pyuVvMI3rVYT:J+a5UYhf5y7/OGf1ivv9PisVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598793, "uuid": "6c8f5321-59d1-4fa4-917e-64fae64f27aa", "value": 1815568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598793, "uuid": "0974055b-b607-4c59-8595-71136e272e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598793, "uuid": "2140998a-8c70-48e0-a4b4-9be403c770c5", "value": "f_ex86.node.decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31e240b-ce93-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764579474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579474, "uuid": "875164e4-ef94-4511-a988-8785e4c38694", "comment": "Malware payload (Mirai)", "value": "7cd1bb21c7f2d6dd9e3f045acfff069e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579474, "uuid": "0f0b4076-d666-43eb-bdff-1a8e143118a2", "comment": "Malware payload (Mirai)", "value": "6901b00d7e4aa059db5e07cefa1119074374f414aa24f2d6d64dc287b8a91889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579474, "uuid": "84631dad-b533-4f27-bce6-dff7efd8b5d1", "comment": "Malware payload (Mirai)", "value": "55fb864b9cd9d18ab23374da5132e1c7fa28e6f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579474, "uuid": "5f652ebf-3a95-409e-9ec3-d484c2c6ed75", "comment": "Malware payload (Mirai)", "value": "1fbd65429da7d7d6c56645a74a65d80b2bee656cfff16dfb23a89d8c3c6da09ce07e23105e195f78b4cef331786002fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579474, "uuid": "a319790f-eda0-45e2-a780-b20b0cb29956", "value": "T10AD3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579474, "uuid": "e30faf7d-a2a2-4652-b56f-56f3516147f5", "value": "3072:o0H21ZnmrUjUGcF9n4FN7njJL3sdugpgy+Nq:of1ZmgZ64Ftnj6kNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764579474, "uuid": "ae5cba95-5c81-4190-a73b-f17ebe9be9cc", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764579474, "uuid": "aa08d26e-13db-462a-8f0f-16b0e6b36311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579474, "uuid": "709ea8e8-bbdc-42be-90f4-f36fa72602ce", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5a4017-ce72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565289, "uuid": "89fdb07f-8fdf-46ed-89c4-4a607e474645", "comment": "Malware payload (Mirai)", "value": "dca0dece6f89f3bbbd4d7bec8e82aff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565289, "uuid": "ca10000e-c741-4d01-a584-9d28ad560981", "comment": "Malware payload (Mirai)", "value": "69088cec7642a50000fbde1039ac7e78f3bbf2c7b8db69e4ce86fd12bbce9479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565289, "uuid": "7edcc5b8-bfbb-48e1-9f50-9a16654c1b93", "comment": "Malware payload (Mirai)", "value": "18fa4d04c2339cc234b577622c7818026b849661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565289, "uuid": "66c5088a-1cc1-4564-acc2-8070d4572a67", "comment": "Malware payload (Mirai)", "value": "17288543c5eca71c9e2f29d7c34b0f785b593f91a47d63dfbea828002ceb99a9a34c1d8afbbe5fb2deadaf0f84145c09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565289, "uuid": "abfeaccd-6fcc-4826-bbad-3f4b29328ee3", "value": "T175A36CC6F643D8F9EC5605303132FB379FB3E5BA1129DA83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565289, "uuid": "0265606d-b5ea-4cdd-a478-f402b109bf2b", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX13FvSr1pAm3Jn5wR54yfZLirIR:FbhWbT+c+sxK2ml3Fvs1Z3vY5XirIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565289, "uuid": "85d53d93-291c-473a-975c-21af9e2c7a70", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565289, "uuid": "1d72f047-9b8f-42ce-a4aa-c7f7231c52cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565289, "uuid": "1eecc021-2f8a-4d24-873f-4f01dbd6e464", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2729d3d8-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764621276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621276, "uuid": "7d584ebc-ae60-4220-9a92-9c8655ea9567", "comment": "Malware payload (Mirai)", "value": "d3b8a9c1ebc37427e49a6532dedd306b", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621276, "uuid": "63fb3cf5-5a3c-47d6-a789-86b4b8e96a94", "comment": "Malware payload (Mirai)", "value": "69370ab87dc801f86a654916c0401edf2eab0dea21d7951ca24d645aafdaf7de", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621276, "uuid": "11ffae15-cf39-4e95-8865-e280f7987187", "comment": "Malware payload (Mirai)", "value": "1dcb220a6afa0f3d72993ad8061433600295697b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621276, "uuid": "ee60844c-4c33-4c25-96a9-8ba949fe56ec", "comment": "Malware payload (Mirai)", "value": "967d2972520e40789b84ed3655fa0497aa914ff5d3a5929805fa889f60c2fb7ca2ab8235dbf8ca73d427df3a498ed732", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621276, "uuid": "d6e7a904-7de5-438d-a447-5754ae84f7a5", "value": "T1965609C1E9A1D28AC63D6D71EFE5EFD8E26A2F315DC85A46C9D8F33E0CB214480B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621276, "uuid": "641cbf34-219c-4172-b46c-0197ddcc24f7", "value": "49152:ppT+LRYd14a6t9eD1iY5zvosUBx3nEbHHL6p8ygHHDt5EQ:ppT+LU1FDPlThpnDjEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621276, "uuid": "76204b1a-f550-4d86-8a38-188c553b3645", "value": 6422676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621276, "uuid": "4a88b676-a437-4195-ba78-9b91bc8431b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621276, "uuid": "7921486b-ae46-471c-9206-3e9610e01ff2", "value": "kiara.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36ad559-ce81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764571744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571744, "uuid": "68067a41-0ee2-4a25-a77c-2eac68b2713e", "comment": "Malware payload (Mirai)", "value": "399b0a79324f337590fe444493f8b3ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571744, "uuid": "56027a0d-3c8a-4886-8edb-0ddbe5d28d87", "comment": "Malware payload (Mirai)", "value": "69669dd446b2d4244c7d11ea3f536012d5890f0c25e66fb64fe1e9afa2e7fc4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571744, "uuid": "ec9bb56b-4887-4223-a043-c4e69373993c", "comment": "Malware payload (Mirai)", "value": "542ec0000b1e4aadee83e350f85720ce370ca0bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571744, "uuid": "bf879601-a7f8-43d9-98f1-9ca6fff2b9d7", "comment": "Malware payload (Mirai)", "value": "e0a48efa71d692117d34d25f452f654e7ef3d865154e836437aabf2a77bb2e2fafc6557bc817e3fb647afe723f295a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571744, "uuid": "0db2e90a-9721-4ee4-a0fb-1b34c951fbba", "value": "T1FE041A05BF210EFBD89BCC3B45F9270525CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571744, "uuid": "06fbc223-75cb-4bd8-9a34-9af753bc9751", "value": "3072:Nb0Nz/BdxtUo6WGSWhSY76lzwQ2RfDNq4N7/iN5qyjXdrF6pzFLd/xjS42cHRapx:NwFBd7USWxQifhd0It3JxYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571744, "uuid": "e61d4e91-3887-4230-a792-ecf4e006018f", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571744, "uuid": "3cdbd6ed-cd15-4c91-acae-67257912d056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571744, "uuid": "80572439-66b7-4d14-96ba-9d1073b0f19b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcc31cb-ceea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764616727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616727, "uuid": "116fae9c-a10e-4f26-98d5-18223cf3b626", "comment": "Malware payload", "value": "9d269d7a373d11bec43b2c7b7bad15b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616727, "uuid": "9f300ec7-882a-4c19-847d-014d8203dba7", "comment": "Malware payload", "value": "6acb851114fdc56205458aa12f2ddc014fc5a0db1cb0d29a6e481d8c40cae044", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616727, "uuid": "39e3c7cf-1fa6-463e-b104-c1fd54077755", "comment": "Malware payload", "value": "7825ad0f9413d49e0ff7845ef05d2110f2bb684d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764616727, "uuid": "8669e937-bce7-41aa-bb8f-02e61e47ba1a", "comment": "Malware payload", "value": "06999c1eabc34859f51b05e9faf482cf542953990aede77d2fa9c0c2f79069c38591c3300e5787d5cf9db842a4de5bf2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616727, "uuid": "33d39ffd-75d7-4e7f-92ac-f8d62b0a6258", "value": "T165E533AD5BC22EF5D842E1340282871A6C3FE1495B54D5FF3D6A32532AEC4CC9B70E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616727, "uuid": "87634272-0db6-4af1-b98d-011b8587973f", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616727, "uuid": "5135a6fc-c45f-42d8-aeee-e424721a38b0", "value": "49152:B3GzaBUfkRn9JvBPjG3o9AugWEVcOkYK+sAFi5pLKwEdR2waua22e6ioZfg:BWz2fR9JvRj6kv+RFiHLKwEOul6Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764616727, "uuid": "f5aa02c4-ec4e-477e-ba96-e18f31e0c328", "value": 3212600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764616727, "uuid": "be2928d7-3e23-4b36-833d-74d6e8b7e564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764616727, "uuid": "48d3839c-df6b-4fe5-99af-fb3e813f3fc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f508a41-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568918, "uuid": "d5874b61-7529-4eb5-b7a1-5c1a01bce5d2", "comment": "Malware payload (Mirai)", "value": "ac696284edfccd17170b283cb5999196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568918, "uuid": "c981a459-1327-4d41-ac72-14f70f151e2f", "comment": "Malware payload (Mirai)", "value": "6aea4b3f8dd415b9716ee71775fd0706098e6a3d8dea933f0ed77343082a3125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568918, "uuid": "6a11880f-1f5a-4369-a6de-fa49f2a3c6a4", "comment": "Malware payload (Mirai)", "value": "7336b262b3a55eecd6eaad913ae53668dc12692f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568918, "uuid": "195e04e9-940a-4f85-8ae6-30f56dadef00", "comment": "Malware payload (Mirai)", "value": "ba010f4edf09a587ec77bca77cb99ba260f425240ef409b20615f34909f65730d7cfeff6a608ae791f6da07a802e4da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568918, "uuid": "adda90d6-bf56-4595-a7b1-d13715137af3", "value": "T10E3302617A32ED7481941F39CE8D804A6E2FDBE4B1CB61326E1C806C5CC665E7FA6346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568918, "uuid": "9cabb11d-5289-4e66-9ed5-d5becd9c836b", "value": "768:lElkr8F6sdFPaW5T7wkihERV8KIP4RV10G1T9UKfsXHtetVJ4audUewma9q3UELt:WO26s+W5T7wkvqKSobf4H0XJ4RduoLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568918, "uuid": "6e823f04-8ab5-42b1-9587-7ba44d51646b", "value": 50320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568918, "uuid": "92e8bb31-f1a2-407a-b7b4-21ecf1e1f499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568918, "uuid": "1d211f70-2200-4ddf-91b6-68b51505b298", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b3c701-ce7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764570293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570293, "uuid": "52fe1708-c9b3-4282-896f-cc310737f602", "comment": "Malware payload (Mirai)", "value": "9c02a8f1fc1ecd7a2e7635b1ba508961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570293, "uuid": "6d22a017-8ac9-4a85-922a-6666bcf673ee", "comment": "Malware payload (Mirai)", "value": "6b6a559991202b063c12923b6fa8c1ca5f5228ed2c3cadcce1046101b001b769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570293, "uuid": "1e864142-f0f9-4a7b-a2e3-ff00797902e9", "comment": "Malware payload (Mirai)", "value": "8336a09d9bd5b7c162f8a9e85aa0fc1b743508f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570293, "uuid": "9e833367-322f-4930-8910-79142439b0c1", "comment": "Malware payload (Mirai)", "value": "9aedca6f90ccea5cea00c38d73680dae7a678dbb3d8fbc61adc6ecdcce2fb48d0b0cfab01e1439e227b4504bb101b3f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570293, "uuid": "d855aa7b-8d6e-4a53-b5c2-c29353748fe6", "value": "T1FC23F131A6F1DD40C43E95B705B9384E99AAB27DF12D4CF54350E42F45BCA3934B54CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570293, "uuid": "4ea69b81-85e8-4810-b6c7-c4cd39bf9b10", "value": "768:+IinmP2YwITjZDXL0LlHwWNE7INafF1a5UzFs26OEQVoAGbjkneOMDk2tB/2Ngsm:+cjLpLgPU+Ea5UKROEeyjkneOMIOBOZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764570293, "uuid": "c15da983-c8d3-4cb1-8d97-f9df3ea21b56", "value": 47320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764570293, "uuid": "756fe498-de00-4241-b668-dc2c76607b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570293, "uuid": "0a0034e9-eb62-4d20-b817-0357432fb5a4", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b745d0-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764577927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577927, "uuid": "9f3bcc31-6d2d-4a63-b194-106fe4a5c4e6", "comment": "Malware payload (Mirai)", "value": "59adbf253cf0376529b761303bed91ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577927, "uuid": "e0580a18-af6c-4509-8d8c-9365728e5b4f", "comment": "Malware payload (Mirai)", "value": "6b8c6f1246e5029cbac808c15f0931e4414b2955f6d771b3ddf11710b1a46a2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577927, "uuid": "326a8da8-a2dd-4b95-9783-55cf17c5b1e2", "comment": "Malware payload (Mirai)", "value": "a4ca84e8414297b05115ae6cb7fe37ed8c80be8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577927, "uuid": "b90f4c2c-ecdb-4337-81a6-714b900d3272", "comment": "Malware payload (Mirai)", "value": "14ba82702336f3965e51804da7caa5204b4b5d96a882b0670eabe2a9b49f87b9ecd4e774bf05e2821ff22a55c1d0d3d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577927, "uuid": "ee8aa3df-2751-4962-bf17-e666f53becb2", "value": "T160D3BE31F025ACA4DC110AB834BB957C1B019EF407E51243EEBEE65E14B7D49BAED6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577927, "uuid": "bccf2d25-0d04-4370-89d7-ff1f36f49418", "value": "3072:rT762b8jItrlvKsHxj/dkuG9k4HANHOZmZc:rT7Pb8st0mxjy/moANE8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764577927, "uuid": "83514008-127b-4eb5-a5b1-c2b3c97bb517", "value": 131668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764577927, "uuid": "0074c54c-292d-40cd-b877-e5d70e7e4485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577927, "uuid": "cf1a6a9e-588a-4308-bcc9-cd461f6f445f", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df7f852-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568916, "uuid": "724e4b41-9b71-435b-bd26-a94d40e58667", "comment": "Malware payload (Mirai)", "value": "56e785f800a1721b3ff622504632347d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568916, "uuid": "52eadf86-721f-45de-b0d7-cb86089baa22", "comment": "Malware payload (Mirai)", "value": "6b8dbe5cea96bfaa75c318614b27fd139f5aba3d7ef63181dc939fa0fd2ce10e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568916, "uuid": "f42c4d5e-2b03-4e5a-96f9-7d184d6455ac", "comment": "Malware payload (Mirai)", "value": "f4efc8c7f970d5a430ced92a25f70c66847fe52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568916, "uuid": "2649c5ed-4c37-4a8d-94d1-9e7eafa4b7fb", "comment": "Malware payload (Mirai)", "value": "8661e359dbb0c7d8a7823e8b87eec68d12fe6e057d110ec8383fc4679f62acab5647e6abe8d4cf76b104a20b52b1f44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568916, "uuid": "ba952c04-57d4-4660-b225-7b502da672aa", "value": "T1DB230223E0F9BF81C432C6B6505E7E0E28999357E1AA4CE257E4F1BB55C3E3526E0187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568916, "uuid": "904e767f-431e-458e-827e-5096c104dc28", "value": "768:NIinmP2YwITjZDXL0LlHwWNE7IjNEbutaEpqK6gWsuA+wC6lcD6ifWEkS6XRtmxZ:NcjLpLgPUFutaEpsaLifc7wd9nouy8GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568916, "uuid": "10d0bb29-b879-4dab-81bf-89e82c665627", "value": 47304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568916, "uuid": "39dcf5bc-4d04-4187-acc6-930d02f31c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568916, "uuid": "94b86825-23d8-481b-9a91-2e8ee65bce37", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e33516-cee5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764614555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614555, "uuid": "492c4bcb-f83c-47a5-ac08-64bdedf4167e", "comment": "Malware payload (Mirai)", "value": "5db0ff2e9dcdce35da778e6115e9d1b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614555, "uuid": "f1a0d370-ab8f-4acb-a2eb-8b6b54dba043", "comment": "Malware payload (Mirai)", "value": "6c1a7f762788131dd10c5c77d738fcd711d994bfd79eaae491b97b6728a284fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614555, "uuid": "82f01bf3-af0a-4dac-9d72-e22033542be8", "comment": "Malware payload (Mirai)", "value": "0f5dce468d6e94b3a1819abb35aa57d737af83bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614555, "uuid": "9642cc88-6762-4c4d-bccc-2b9092a8e054", "comment": "Malware payload (Mirai)", "value": "2150a380f38f66d920ae86233b3b187756afff91fb2016385c50a6163b6d7e4deac14f3e02b86240a5787215b2d04185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614555, "uuid": "659ac270-e2ea-487a-9ca2-ec7e9a9ad817", "value": "T1FDA36DDAF401DD3DF84AD7BB40670609BA24936117930F3BA69EFDD73D321A85A12E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614555, "uuid": "6eb4b831-649c-4d6b-977c-8d06d3a74646", "value": "1536:2s8CLTLez3aZGV481YJKt8cbvr6LhGq8ncMDX8gjmcj05PT:25OvWKkV4cYJKlHqkN790FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764614555, "uuid": "fd8061c9-6b9e-4cb9-83f2-14efa60dc876", "value": 101808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764614555, "uuid": "5182d11d-c246-4065-9ee0-736936aed194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614555, "uuid": "5d0ea0c4-00f7-40f8-866d-f64213c292d1", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcd896f-ce78-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764567845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567845, "uuid": "c0d07da4-6c46-4690-b574-01270e8ef0f9", "comment": "Malware payload (Stealc)", "value": "b347f144a4b4fe30b79fe434f9f4ff80", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567845, "uuid": "09d992fe-2d27-4385-b05b-fc48106153c3", "comment": "Malware payload (Stealc)", "value": "6c5f42ec054e84f7a39749e1aedf89dd746747124a3068beeae21dd5021c1b43", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567845, "uuid": "d32f549e-dae1-4e2d-9f55-9153ba9345a2", "comment": "Malware payload (Stealc)", "value": "6436e03e05be9f82960a7afebd6b67298b5a9b44", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567845, "uuid": "bdef9d5e-dd8b-4084-8a25-3dbda195d7a8", "comment": "Malware payload (Stealc)", "value": "7fc7987cec9f8701c5efb5400da3ff73779d56841bb4e6387fb87b10ee4c23a4950088b2f8f9443d060b4caed656ae04", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567845, "uuid": "fa09e28d-f0c0-41ea-8bcc-fc7cd67e3be0", "value": "T10036E6C2F950D2A4CD9AE9F8ACE191916D63BC584F3132D30E627A720D767C43A76378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567845, "uuid": "cbc5173b-d2ba-49be-b1f5-daf763462abf", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567845, "uuid": "5d5c9e2a-f7bc-44d2-8180-b764f69fe10e", "value": "49152:wXTpRN0kOxwyY8J/OE/g8fc4uDN90FCPTTCD7g+MdiC6D1d2s:9xaR4eN9CKgLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567845, "uuid": "d6883836-e320-4c35-a5e2-29abc461b14f", "value": 4926680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567845, "uuid": "82b0f872-5265-4444-8449-a086e528b23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567845, "uuid": "604eee2e-69d0-4d35-a5a1-b2ed2a9f58b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf2a238-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764578039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578039, "uuid": "8fa92262-f25b-4103-b1bd-ba0c73048936", "comment": "Malware payload (Mirai)", "value": "fbffd3e3f6bd510e1a14b945bac4a629", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578039, "uuid": "e7629472-390d-4ae8-9de8-0e66aeaebb96", "comment": "Malware payload (Mirai)", "value": "6d32c062fe4fa9c4d0e0b3c4550a78a95a2d55d2a60cb628085bc26ca34e5e6e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578039, "uuid": "d704d26d-6a80-4a56-b62b-ea2951527736", "comment": "Malware payload (Mirai)", "value": "e33e61121efedeafb6ab8a5d4660f6c585df107a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578039, "uuid": "3b4fcc81-66f5-480b-b35e-87eceec393bd", "comment": "Malware payload (Mirai)", "value": "20a43ead20a937c94477f31b717b8ec29905a64800ae4c6cad4852f4c52d913f79905629acdcafce0a8dcfed3d3d126e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578039, "uuid": "7c758a38-d45c-489c-8d2b-ce5e0a70a6eb", "value": "T102B0128D81FD04C30C248800A460A0A07448537057504E3CFC5444716400D09B0E0700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578039, "uuid": "659f3372-ad2c-4dd3-98bc-918e0d430738", "value": "3:TKH4vGBwkSDk3LWEXK5mEchd4KJ8:hBDCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578039, "uuid": "3f0591c6-8ed0-4cbe-9cbd-552e5c341bc6", "value": 94, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578039, "uuid": "99b7846e-652a-4a92-aeb3-44975f52d69d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578039, "uuid": "a1b2ad84-d0ca-4433-aca0-2cf813010733", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f35f6f4-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583950, "uuid": "91df0617-ced1-4d12-9141-dca873b04082", "comment": "Malware payload (Mirai)", "value": "d8ce5b76de840025ce67bcd86ad25546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583950, "uuid": "bb978ed3-79ef-4976-8fb4-c7a1fd2fd9a5", "comment": "Malware payload (Mirai)", "value": "6d52cd067004a59e084051bb819bcbbaf86316922e1a1bf363063a4a8cce3c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583950, "uuid": "93caf331-841b-4bf9-8afd-8085242d7ae3", "comment": "Malware payload (Mirai)", "value": "55d4cc51944a714fba3c26a68c7e9b8034b4a3ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583950, "uuid": "37266c60-2973-4639-a12a-177429364f82", "comment": "Malware payload (Mirai)", "value": "9f2e53ecaa94f8687454be5d94723e57e8429d7a7d44dfc2a5feb349c8f253537a8c39becefdee3139af8202e71f2881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583950, "uuid": "4b01929b-3949-49df-b03d-ca7fc0f3928c", "value": "T1C7B37D21B4381E27C4E1947B22F74766F1F657D920A8CA1F7E720E8EFF256502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583950, "uuid": "f998694b-2bb6-424f-80d5-7cb01a552612", "value": "1536:ZHIO8eULmvhQRTn7bn98OTgebNc9hf6aC9g+ZtHYN+XFs6HtaD3Ym5rYM5J5tAJU:lIEroMHf6BUN+Wow7YO8RVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583950, "uuid": "ba4398d9-09cc-4d30-9393-f663167972f8", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583950, "uuid": "252b021a-af9f-49bc-9441-a8e501d7e02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583950, "uuid": "b2d62049-83ee-450c-a26a-7d996c4ba091", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efe689b-cec2-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764599412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599412, "uuid": "75aae6d6-ee39-4f92-8fe4-4f6161b2794d", "comment": "Malware payload (RedLineStealer)", "value": "7351308f6e77237a116198edfe7ccd23", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599412, "uuid": "55a8b019-b9ac-4a1e-b088-6a090a864459", "comment": "Malware payload (RedLineStealer)", "value": "6e229b8927bfa163a069c832a4239826d3c18bd85d6f457aab51f9caa4ba4d3d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599412, "uuid": "5f3e96f6-7b2e-4e3c-a428-9f07025c4a23", "comment": "Malware payload (RedLineStealer)", "value": "41b018453cc0e58dfe74eb76851af5a9c4440a2e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599412, "uuid": "27fbe7cd-bcbc-4677-bc53-d3dca4c191a8", "comment": "Malware payload (RedLineStealer)", "value": "dbae4eae13b36e32e523bc64004b96b7c88da8339f00bb0d87eaf13b059feed4e64e88a2efebacf23d220808211ba6f8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599412, "uuid": "1cb1d042-8bc0-40ab-8254-12b67fae0874", "value": "T146E423827F2428FEF9180D174B3FF75E2D4987A99BDAEA0B43D10CB9A144FD695192C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599412, "uuid": "92a41956-00a3-4f0d-98b9-36ab925590bb", "value": "12288:aXVLl4rsxFIRQGY5Tzsun9NEBvDL1jBj+At2D//Lqfct5WbuVJPIoEPSuRWG3UBf:alpsYFP5vzn9N6vDtBj+o/YwuzPY6uRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599412, "uuid": "343197d7-d82b-4a95-85e5-3ad90c1ff9b1", "value": 679712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599412, "uuid": "657dff11-306f-4ee1-a9cf-e288b0d1af46", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599412, "uuid": "e9f24936-9e8c-4454-b342-04b71c881d91", "value": "nOriginal_Shipment_Documents_tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f512538d-ce83-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764572659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572659, "uuid": "e62d3ccd-6d77-4004-8496-2f64a72e3079", "comment": "Malware payload (Formbook)", "value": "75bd5db0132c557de35627d412f5eae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572659, "uuid": "c6a0f430-78a7-44e2-b574-251936a4443e", "comment": "Malware payload (Formbook)", "value": "6ea09c48559f1730cd4e346d3b10791b9a5c9d4adb44079793fbe608b288af2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572659, "uuid": "d95b7200-8a98-4bf3-9c1b-9b77c048446a", "comment": "Malware payload (Formbook)", "value": "fbc35006340cc837fc78c3d09fba13bc109e5eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572659, "uuid": "f35c1677-78ed-44dd-961d-74d9bc1c7ce1", "comment": "Malware payload (Formbook)", "value": "11c003492289aaffd0d5860ffb46aaf45f86a53095bff1caf000fcccc131bfd66e6d29a3452b4f484f7a127f72c7efbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572659, "uuid": "215cb823-7c96-4c10-aef4-4d928dc70e10", "value": "T110F412274A58CF53C46147F62D63CA74A73A1F0CA562E7CA0BEA5DCF7D207124C8C26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572659, "uuid": "63418ee4-d234-40fe-944a-800d25f8e636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572659, "uuid": "3b990450-d589-485c-b9ef-e822c391952d", "value": "24576:j1GER+GPs4kyF1YlUlNU9ihBM52yR5+C:jQEUGPshyF26N4ihq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572659, "uuid": "ddcb382c-a543-47f0-b110-6d9e1b99d9e9", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572659, "uuid": "e768ab39-1070-4f0a-8d86-6df6494c7877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572659, "uuid": "7057c992-68b2-4497-bd72-1522e7e6cebc", "value": "PO-JAN-25081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30da4d22-cec7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764601536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601536, "uuid": "ebfce554-4756-4603-b73c-5b7c73447a7b", "comment": "Malware payload", "value": "aca90bbed7c0666062b4ed1433e2b06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601536, "uuid": "140143fa-a927-49f0-b7f0-ace4c7519527", "comment": "Malware payload", "value": "71fcf028ef2cd93678af164c9ecd62201542c6f6c647c035d83b39be10b60a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601536, "uuid": "c2a60481-9adc-4c8a-9c40-cb504df6cfe6", "comment": "Malware payload", "value": "bc5319a32b7f45925d14a0419ccd9c2945835402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601536, "uuid": "b1bdec47-1f91-4bec-a64a-2ef2c4f5cbcd", "comment": "Malware payload", "value": "093aa6878e72e2dd4d91733c221ef94e0537b3d8cbf8450bea7a2c6dafe694b833bfb85cc7b2d0904f9e9360d22216a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601536, "uuid": "f1fa8c04-9071-40c7-830f-5b42bb0a232f", "value": "T19AF402175658DB13E4259BF53E33DA7517B23E0DA521E29F8DE74CCB7820B214C88A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601536, "uuid": "43624396-9325-47bc-9b75-8ba9206776fb", "value": "12288:Rb55h9xHCo8bP1Ur/L4xhOjYI3AcQM7gZwUAu11z3WChCuDZ03XDsZJ2I208hZ:dVDCB+/kHyYInQMWZpmIDZWYZJ2IsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601536, "uuid": "8d428643-e0e0-4ef2-a5ea-a0dd67ee10f2", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601536, "uuid": "fe234a69-f072-4e16-aa46-3b047b0b0529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601536, "uuid": "320ea690-44fe-4a8d-b5c5-9e0f7b41dcee", "value": "Shipment AWB 176-94996963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2480f9f3-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764599797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599797, "uuid": "870647ce-60b6-4d51-9019-a45bee1353c6", "comment": "Malware payload (AsyncRAT)", "value": "16802eeb2eff09b84fc7c6c491105f85", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599797, "uuid": "6962e3fd-be12-41b9-8777-600bad7f0c99", "comment": "Malware payload (AsyncRAT)", "value": "73641a6dd5f95201524760fb4b5e951dba1fa239bce351d6e765021ab08de01f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599797, "uuid": "2a47aabf-06e1-4957-88b2-9a0e79565fc4", "comment": "Malware payload (AsyncRAT)", "value": "4c7de2517bf37b7d88c08326813beba0f48d65dd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599797, "uuid": "b2ee01f3-17ee-4e79-89e3-1448920e1aba", "comment": "Malware payload (AsyncRAT)", "value": "6c5eb0d9dfb2f7ef3097215c89d1ae91475cc62cb0efdaab37b139e6ee80e8d9256d2dc103a9da9cdfed24cc927ee6dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599797, "uuid": "103e7a6b-e146-49ce-b040-ba7e9115b663", "value": "T1F8E4BE002BAF4F58E5FAA7386D3852114BF0FC0EC736D68E6DD449DE2962BA08B51753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599797, "uuid": "478f9e9c-6420-4b44-b121-9b43adc0d6d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599797, "uuid": "b231ce3f-37e6-45e8-938b-672b8285abfc", "value": "12288:ItrXdFIjNF1rfQ9vpF2cCCDPsvGMgNwz+0fSBvLU:nF1rI9hNCAPsv6+ivo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599797, "uuid": "be22b923-b303-416e-af3e-49fa4f53c0a4", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599797, "uuid": "a88b302c-95bb-4434-a89a-9cfa02780c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599797, "uuid": "80101e42-bc74-4614-8c6b-3e23a2bf2963", "value": "STXF-COMMOSA_QUOTATION.....2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d0c783-ce84-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764572828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572828, "uuid": "2a24e90f-18ec-4f3a-b25a-40cc12f6baa6", "comment": "Malware payload", "value": "70709f8e2983f5ade59dc5c89bdbb711", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572828, "uuid": "760d15cb-f9ab-4fe4-82aa-56abf9272be3", "comment": "Malware payload", "value": "743145fef1fd05e1b5cb13b54af779e1e1473728a8ff90ece07af21fdb311e10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572828, "uuid": "2b98cf74-8fca-4d2a-a3f0-15d26110cb6e", "comment": "Malware payload", "value": "61cc3d38c1921a1d0e47907bfa7da7e0ee60b785", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572828, "uuid": "39c55f3e-a47c-46ff-b33b-a301bdbbb877", "comment": "Malware payload", "value": "d54f3feccf62805245d06f29f356d4e3a46186aaa4a6c275582019da6bde327fb3b41bfa09cca446b671779f510a250c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572828, "uuid": "725f0a71-466b-46c0-a72e-b18698977902", "value": "T18514608427C4785513C71F7A372BF9E9ED1B08E876484C97E204BCE0B1B5A16EAE5E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572828, "uuid": "fcb49e06-680e-4102-8467-0c08e4361bfa", "value": "3072:SwFkTjt9vs/PdVZSuejtUmxZs3e/Zc7V1x1JAlUTuzrTA:SOIjt90dVZSuejtXq3+m7V1x1puE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572828, "uuid": "758e3eaf-e206-407e-8eae-f3c786070da3", "value": 203917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572828, "uuid": "7d6e0a9c-31b1-49ed-b682-c542e55fd92f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572828, "uuid": "a2e38daa-f1ab-4826-a007-efbf8b5bc641", "value": "S\u0130PAR\u0130\u015e FORMU-28-11-2025_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97b4d2a-cf02-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764627186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627186, "uuid": "66044a88-c455-4a1b-8fa3-dbc5cc2f273a", "comment": "Malware payload (Mirai)", "value": "6fa93ea93d94120e56797684c5121f60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627186, "uuid": "d2f98b30-8619-4f2a-bed9-775955603a57", "comment": "Malware payload (Mirai)", "value": "74c8b1f7685357f709b4ae894f2072a715fef32bd2f262bdd12b09f48080bc9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627186, "uuid": "7d79ec75-4789-4358-8982-89c3ac2b6e25", "comment": "Malware payload (Mirai)", "value": "d4e6dbee0885730ba2ca980d453916daf6221877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627186, "uuid": "33b5d010-a1f6-48cb-9ccf-c97d61567a6e", "comment": "Malware payload (Mirai)", "value": "cd56a32a4b7880b38d3b71cab87aa6857676410e9d82ca28f695c24decfb38e8a2d35472dcbb01128f5141aa7b9017e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627186, "uuid": "a9781f90-f71b-4aca-8d79-a226b203a8ea", "value": "T183044E42DA818E13C4D6277AB6EF414A33329764D3DB730689287FB43F8676E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627186, "uuid": "1a22b4de-e9b5-4d37-abda-2eb25561f163", "value": "3072:uu/WkBR7fqmY8tU+jaEBwYh6YWbsnneIq4yknK76rvRM/9ODWAHNFR:BjH5JjaEBwYh6YQsnRHK76rZM/9OKAH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764627186, "uuid": "b0f4d698-2dc0-4089-b6a9-704776daa9b7", "value": 185482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764627186, "uuid": "86ff7eb3-fb5d-4216-9af6-ca329e99b49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627186, "uuid": "54134f4d-e150-4b18-bf1a-46bf3c62638c", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4ab61e-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620852, "uuid": "1b048f91-4bd6-40d1-9fc8-7a1a7d6d398f", "comment": "Malware payload", "value": "13e391a10a0724fe27283eee993ad9b3", "object_relation": "md5", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620852, "uuid": "d2fd83d0-8474-4cb0-81d6-a3e53a517fed", "comment": "Malware payload", "value": "767591c7ab54ee46f6617723426bd00af661a6eac14a6c26874da2f078eefb8a", "object_relation": "sha256", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620852, "uuid": "a36b1d16-6d1d-4ba1-b34a-9a5adf9e79eb", "comment": "Malware payload", "value": "978dedda13ca8ecde1443d888f1662037dcc78ec", "object_relation": "sha1", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620852, "uuid": "21c169ec-18f2-405f-859e-3b8bd8953c72", "comment": "Malware payload", "value": "56804eda32cf9fb08757079ff3dfc94b1bfd47458a75672b0df6562010934968308b4374b255a707f9f654c9f23dc838", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-79-179", "colour": "#624C82", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620852, "uuid": "bac0a39e-7c7f-44bd-9024-b2f301962d28", "value": "T1ED86E112A2818433D0271E3A8C2ED7C458257E701F24D54B7EBE7E4D6E39B46AB353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620852, "uuid": "eb919718-68e1-4bdb-8402-b48848617d31", "value": "8cdbaede84ac3856e020e1db546b0bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620852, "uuid": "ac7a9255-3cd1-4025-b07f-4db3ccc83080", "value": "98304:xHrVoFYNCBJCdnxTp8YcIQSzAqnbb+KdJRmKoWDJ8gyhOTR1ut3ExvcYDZ80ngRD:VWF78dxTdjpbb+OyKpDbq14dhgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620852, "uuid": "9d17e1eb-0292-449b-ae16-3703dfd1c362", "value": 7882480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620852, "uuid": "90c3e506-f8fc-4c70-86f3-0b2de3f75162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620852, "uuid": "afb65807-d961-472e-9221-5e027301de1f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd9a664-ceac-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764589907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589907, "uuid": "ee62e4a4-ec61-468a-918b-50e8279f8f8e", "comment": "Malware payload (AgentTesla)", "value": "f8f81927707d647b3764dbb6ec06f05e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589907, "uuid": "1e6bf08f-b7dc-4d07-b63d-08b90c7a1d94", "comment": "Malware payload (AgentTesla)", "value": "76eb5550e61bd5303fa62edfd9ae07b50159b22afc9034f9f5add37d36252188", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589907, "uuid": "7517db19-cd95-458b-94c9-74314aa4aa3c", "comment": "Malware payload (AgentTesla)", "value": "e6665d8e83b931d5b1377da8ea8be6e5e30ed583", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589907, "uuid": "d46621b3-f227-4ba3-ae5d-5b7aa49b0b02", "comment": "Malware payload (AgentTesla)", "value": "4ee103c9a9a985d7785c4e154a0e1eaa6c2742f997411e44fb23fe7649184eecfbe19a6ee4ddba7bc382ea02703873f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589907, "uuid": "d3f925e7-ee3f-4e6c-8899-2d8b314e342f", "value": "T1FEF4535273C0786423475B3A772FF0E5EE1B88E87658044BD126BCB0A67D71AEED4932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589907, "uuid": "be184d51-71ea-4c08-b1b7-368e739d3906", "value": "12288:rs1jZtGk1auDi2uigtwpNpZHscN+OB46ZR/l4yNcSAQhdKZO0:rs1jZtGkri21scxSy4yNs8dKZO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589907, "uuid": "ad033acd-72c1-4338-90fd-1a3d8bb1cf6f", "value": 771986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589907, "uuid": "06faadd1-40a7-48c4-9547-6368f06f4222", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589907, "uuid": "1f49f87a-7afd-4965-9efe-6f42a25faa65", "value": "RHK0987654567890000000.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a15581-ceab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764589571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589571, "uuid": "75e867c7-7506-4a42-bf72-6712328a2444", "comment": "Malware payload (Mirai)", "value": "73e2b6785573304ca915229d0528e85f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589571, "uuid": "90c42c46-ec8b-434e-997c-144f0dbc0608", "comment": "Malware payload (Mirai)", "value": "7707ef31de6d4720b9a3b95cbeaf110adc3cf372e166a7b872680413e2d4e789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589571, "uuid": "a8bf01ba-6c5a-4ad5-af7a-306bb243aafc", "comment": "Malware payload (Mirai)", "value": "bbd24d0d6468c1d6609bdbf756e78b03da076cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589571, "uuid": "3a5dd9d1-1223-4609-bb7d-bede3a7c0587", "comment": "Malware payload (Mirai)", "value": "d5222ad8e9c6aec78d117319f4d561836ab3d5fbb181e23d910c4436237fba892132bd02f1bec7b2277cb4959e74d490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589571, "uuid": "f1166b9c-1dcd-4d55-abd4-c6078fa0e7d9", "value": "T1E4146C2BB3C3ACEAD51063305C3163627B1FCB051914EBFBDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589571, "uuid": "3c2d8c39-d12c-4087-a06a-a243b3fb32b8", "value": "3072:ettOm515t5iumY12E5c5QH4bOKWSjROUSbIBUT3arKrFXB7IKZ5t5+:ettOm515t5iumYVWWwTUtrFx7IKTtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589571, "uuid": "962a3fbc-398b-4664-af79-293536b11f05", "value": 197384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589571, "uuid": "59fbe59c-8fa7-42b8-8fe0-8aae22e8f808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589571, "uuid": "f43c75d7-a76c-4402-80c8-1d5ed38bbe03", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782fbb1f-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578033, "uuid": "e2d5bd53-23aa-4766-9b70-660be423f622", "comment": "Malware payload", "value": "11dfe88b9133624d3d3e1be8e1ec6a93", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578033, "uuid": "afa609ff-5fe1-45f9-9283-7ad87480156d", "comment": "Malware payload", "value": "774af64259ad726296fb4fc56ca91897c7da9acb3a10ad49325ead714f6562c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578033, "uuid": "2cfe23f7-5bcc-41d9-a8b2-8d316c4dc74e", "comment": "Malware payload", "value": "38de1bbdf44f9bcbeb320d86818dc0fba27d825c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578033, "uuid": "9bc11837-e0a9-4516-ac5d-8ce307bb07fb", "comment": "Malware payload", "value": "4b420a6cb6c9bbd3fb5af6941647a90502882ed18ec58f5394bb92e7f52e216ca05237bf059bd3a25e8c22a9f5172302", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578033, "uuid": "90184478-dda1-4411-a611-083f7eecdfa2", "value": "T12556E0846349BE97C47B41772CDA027B120DFF55AA49A363F542FB1CB8369B84D18F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578033, "uuid": "63e03e76-cbcd-4cb7-85c0-e925a276cf34", "value": "98304:rqL7GwX130pbkO/DvdosfewfekVoJGTe0qFgkh642c5gX4p01VAazaIhax:rqL71ZKwO/Dvnf1OAePgkh6hcKXlA+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578033, "uuid": "835a858a-9609-42d1-8b67-58dfb409f033", "value": 6089593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578033, "uuid": "7c05e57f-50cd-4c25-a6bd-395592d8c36f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578033, "uuid": "507916a0-7f81-4052-b84c-466593bdc150", "value": "mParivahanV4.04.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40b6010-ce95-11f0-a129-42010a9c0007", "comment": "Malware payload (PowershellEmpire)", "timestamp": 1764580335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764580335, "uuid": "ea3652f3-c090-4d9f-91a4-709493a79dc0", "comment": "Malware payload (PowershellEmpire)", "value": "0988c5dd1fc8f63bdf84c4107a5c9a9a", "object_relation": "md5", "Tag": [ { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764580335, "uuid": "9a98de11-3147-44d8-92dd-664eab25bb53", "comment": "Malware payload (PowershellEmpire)", "value": "785d8f70dea1a2cac7b63c00583c3f9fe6faa298a304eb2104a9cc0a73ce2e74", "object_relation": "sha256", "Tag": [ { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764580335, "uuid": "478ead66-d129-4ae7-985c-61507f3141d8", "comment": "Malware payload (PowershellEmpire)", "value": "197bb89d270e29860f61fc39f621170831c94ff9", "object_relation": "sha1", "Tag": [ { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764580335, "uuid": "ff1c8dd3-dd62-46cf-aab1-b7f41cd9713f", "comment": "Malware payload (PowershellEmpire)", "value": "5ff39d2bff7d5bb360ba0974ba7726b2228d5a827bbc74b35b923f856023af5ddb1042c32a49ba43dd7b02e2b5c6762d", "object_relation": "sha3-384", "Tag": [ { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764580335, "uuid": "d7c51e5a-6a5b-4091-81d4-643dde5ea2d8", "value": "T11741D505745CE2B38231218191ED77D81B13CE57B1A361EC2361B44FCD2ECE6153469A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764580335, "uuid": "5ca88224-0246-4a11-88c0-e3f0b5b0ebc6", "value": "24:+DZhFSG48FCAkZuF1RzmfTqofty9Oap1QwOYc4cpTusEqOAmV/v5NN0O:+DZNnCAkgbRafTlta5Q/imTGGi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764580335, "uuid": "8bc9f31a-f27e-490f-adc9-3c95adfe8018", "value": 2087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764580335, "uuid": "6000f503-b3a1-4817-a1a1-a73a695af208", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764580335, "uuid": "1a9ac5a2-6a46-4013-9df4-f25d22f2d9b2", "value": "OneDriveUpdate.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f026193-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547523, "uuid": "760dfdfe-312b-42a7-a1e0-1b8ad49c6eb6", "comment": "Malware payload (Mirai)", "value": "70ffe18671f71817c3c31b77683e2cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547523, "uuid": "2b30ba13-9445-4eb8-9eb3-076beec1ae8c", "comment": "Malware payload (Mirai)", "value": "7911235d23601c587076ecaf3793e4db32a30495df22568011345d972a79662a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547523, "uuid": "d0a11437-df9a-4b06-949e-a4ae378f2d61", "comment": "Malware payload (Mirai)", "value": "98e299dc923363e060c34e32a35a9cb4857adc1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547523, "uuid": "bec8155c-a9dc-4916-aca8-6b6fabf43c87", "comment": "Malware payload (Mirai)", "value": "fe9ea7539eb427d3554c9cc3023f07d1e32a909f7d99451acceff17afbeb03c60ba73febc16284940a1b7e718918820c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547523, "uuid": "5d4d3f9b-9527-4d57-9af7-2311f8b14ff4", "value": "T19B830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547523, "uuid": "b364df95-6730-46a0-a111-7a7b4be21274", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFO1OCHYmKgAHCe:EPmBcPJUqiBlV34O1OC43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547523, "uuid": "cca4010f-29e7-43e2-ae92-df1c763671c9", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547523, "uuid": "3c850122-32c4-4f99-a558-8302d373acca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547523, "uuid": "4ececf8f-6daf-4ba5-b038-ede1afc603a4", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7d87c3-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578037, "uuid": "aedaad8b-109d-47e3-93fd-c5a8058d14f3", "comment": "Malware payload", "value": "718baf7e89e876c8123576b2b5e5e4d7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578037, "uuid": "bf1ed890-9acc-4731-95e3-10460368ad66", "comment": "Malware payload", "value": "7922ffb7deea4e27a59fde82551a869354d12c3c8d57a49e4604cc809854df24", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578037, "uuid": "28c1643b-055e-4e77-85b9-51328312c6af", "comment": "Malware payload", "value": "331a30b324793482b7a137c8a6eecae1d5703f70", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578037, "uuid": "c2651740-5c18-4c76-9a40-98a4c3192ded", "comment": "Malware payload", "value": "c392b2bfba95664d9062b3348c1a46e28d84876121d23d03c0640fdd9e0c9ae29b9c5a36b029a4aa681f511225cf2350", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578037, "uuid": "55e966d7-9612-4c52-83f9-bd6752b6a982", "value": "T18EA5F133D47E285DD4110CB3A9AF53A1262343821215FB2F4A789E653987F361F25BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578037, "uuid": "afc92386-fbcc-4ba2-8d38-3cf560d11afc", "value": "49152:zkXmHgFBJq1D4fvIueQNOtNsk+LiulmZG:YXmHgkovIueQN4bnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578037, "uuid": "7efbdcbd-295d-4392-a0ee-c3968b574800", "value": 2103174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578037, "uuid": "3e00a389-4ec4-4aa0-82b9-f36839e61d1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578037, "uuid": "b2b06d72-76a8-49bd-bf84-3ad1e71728c0", "value": "top8bet.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb5f469-cec5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764600910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600910, "uuid": "d8ba9065-0940-4fdb-9656-741a6c6ab59b", "comment": "Malware payload", "value": "82fab9c340a06c76515b5669900930df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600910, "uuid": "8128504b-9e81-4511-adf8-285948178a1f", "comment": "Malware payload", "value": "799836a473f4103248c46c97ca8d27ce0e6091add1aacb838fa1b557ce800a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600910, "uuid": "6613642e-45b7-4c34-9d88-7854a40fbc69", "comment": "Malware payload", "value": "eb0d5dc1b46d6bdbe75b937cd1da56c32e21f483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600910, "uuid": "0530b927-5c63-4501-a97a-69dc8086ee8b", "comment": "Malware payload", "value": "ca008cf50282c85a93a4d6922831bc8005c80211b9afe7e25eab371eb0541aec01e72ca43898b74335df3a76c64ea35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600910, "uuid": "666ac302-7b24-446a-825d-1208c13bfad4", "value": "T16E548566E650703AF99B587539A8A98779293C732A40EC1BF7804B97387279371F070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600910, "uuid": "2187ce4d-2baf-4f77-bc9e-95a59537db47", "value": "64f88194f8df5461a01a6f58f5206634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600910, "uuid": "c3d1c086-6efc-4d3a-bfb8-43ef563099bb", "value": "6144:LlhBpZ09NkMQP8Yiay6IwdXZaPLc+lv1YWHEgKW08VaYldIy3UsChNxoJ5/o7tn/:DZ09Nuiv6Ibjc+ldYWH2Co7tnBMVI83c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764600910, "uuid": "928e7fbf-a8d8-4360-9db6-063dcf18d1d6", "value": 303179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764600910, "uuid": "55aefbb8-bf75-44fa-86ef-a12154cd29df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600910, "uuid": "546da0e7-41eb-47d6-9365-436ec9d9d6ac", "value": "Factura n 00829 y detalles de entrega_________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57301b8d-ced0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764605465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605465, "uuid": "9af5405d-02b0-47bb-88e9-0ca528099a87", "comment": "Malware payload", "value": "d6928160643a1533b0a17655bc021149", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605465, "uuid": "c0fef8cc-aeb1-4ad0-81ba-655f2685c725", "comment": "Malware payload", "value": "79d8bd52e89937cfe03ae1c1daca322913ff8a5846fe93febd558b0deaff5ab9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605465, "uuid": "66a2c023-d0a7-4be0-a169-9416c523097c", "comment": "Malware payload", "value": "3c6f62338439fa25619a2522e99b8118dd9e5665", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605465, "uuid": "6ccde605-2090-4894-82d8-abb84288bce0", "comment": "Malware payload", "value": "61b418f9f67614c6edc91ce65fe07e14320de8317d7fe46b5d6dfae5afc1ed7be02b905f34a28269faa42e7c9fdbde98", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605465, "uuid": "dd21b81f-497d-46bc-9a2e-e7a442dfb4db", "value": "T184C7239EE7E8783EC4764237E94A4236B6691E30E746C31B5909F30928F3DD4C646EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605465, "uuid": "0e48340f-b734-4f6f-be18-396478064898", "value": "1572864:GaOeL4ZdkaGrcgGei/Tvn6E714ERulCHhB1d2ORzGQgQAwJ:GajhA/ThSYH5d2ORU3wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764605465, "uuid": "0cfd8b2b-b56f-4a1a-96a8-0955f26f2478", "value": 56387611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764605465, "uuid": "84b6032a-22b9-40f7-b160-1d3b932d84ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605465, "uuid": "e06a1ea2-0971-42de-9c3f-10c4135a93a8", "value": "d6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2b5f74-ce66-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764560108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764560108, "uuid": "9d16e128-c2de-4c6e-a951-ae281e658800", "comment": "Malware payload (Loki)", "value": "c762581ddd5a6741513e35db24d6de3a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764560108, "uuid": "782cc739-c121-4d91-b72c-efb50db59dbe", "comment": "Malware payload (Loki)", "value": "7a97229ab5c1e0fb376635abfa1c2833344b326b5e00d01be978c9cc1d7d263e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764560108, "uuid": "f65c767e-91be-43e8-b9ac-36757603f076", "comment": "Malware payload (Loki)", "value": "3c1f1121dbdc2b65d5583dc1450f1058447f4f7e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764560108, "uuid": "a1845621-5a35-4d9f-a4fa-33b6aba28e35", "comment": "Malware payload (Loki)", "value": "714a7f87ab5d7e6751fbe9d11245a9d3c068aed9022a210a3bf76c0d931d71ea8acc6844ed453e782b7751a89d4d3861", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764560108, "uuid": "ffb2e7f3-73c7-4d38-b889-569782470885", "value": "T1AEE3DF7835E5FC1AFDA0C0305EB6CABEF769AC14B9C2412712063F3D193A6E98726745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764560108, "uuid": "13b2a679-b912-4b7f-bcc1-419850ee9bb4", "value": "3072:4H/pTzyqtdQ2YJlAZiV8Tt5hi76N7X872Rx8DI1uQ/UwQ4g9P:2/pyqvQ3JleikvhE6VXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764560108, "uuid": "2ab9a690-8dc5-42e0-b192-8af9d73b4f10", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764560108, "uuid": "1bed2403-c4e8-4ed7-8b39-d5754bdd7336", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764560108, "uuid": "19b775ec-c856-4f15-9aee-3c2c4ba90d69", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f111c347-ceb0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764591980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591980, "uuid": "3a43bc8d-c2e4-4360-a2f0-48c22d96855c", "comment": "Malware payload (Mirai)", "value": "7a7bea939507b660f964d7111933ba16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591980, "uuid": "9de88d7e-ca91-427d-9bb0-86daab77d0d2", "comment": "Malware payload (Mirai)", "value": "7cee51cf30d332a319b127bc8b3d6cff7c07d9e069ac0021f8c16c81c9cab036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591980, "uuid": "5c89727a-ee1c-43cc-8d19-c5d17d75f7d4", "comment": "Malware payload (Mirai)", "value": "2be647eee4b207ee3618f94dc05af408e8678307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591980, "uuid": "f8b9f602-811c-43df-9a50-368aad876471", "comment": "Malware payload (Mirai)", "value": "b31dc1067c6d13307c68dc69b652e6b552a61e70cbf7ac7ed312cebe2b91790c4a999b5256901a7b18a8a47827915b14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591980, "uuid": "3ed5ab48-5b33-43ac-b4c6-42a652e344d7", "value": "T116A36CD6F643D8F9EC5605303132FB379F72E5BA1129DA83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591980, "uuid": "c55743a5-0ac6-453f-ad0e-71dafa52d772", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1CFvSr1pAm3Jn5wR54yfZLiaJf:FbhWbT+c+sxK2mlCFvs1Z3vY5XiaJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764591980, "uuid": "6541b632-4359-4c58-a88d-04dfdb1415f7", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764591980, "uuid": "b8733ae5-1fc4-40d0-8dad-c24d5f307b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591980, "uuid": "f310c053-07cc-492e-a12f-c84437a7927d", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efe05d2-ce59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764554234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554234, "uuid": "d0be0f2d-48c0-432e-bcb0-6367351521ce", "comment": "Malware payload (Mirai)", "value": "301e8c6f70de02109d34cbfceafb3fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554234, "uuid": "5d7fa1ce-afed-4e3c-9b31-0bd6c352383e", "comment": "Malware payload (Mirai)", "value": "7d13cef22c689d32297863809f7700df18de7ff3c6c60a77dd480f83a4341728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554234, "uuid": "4f8791bf-f37c-4b8d-99cf-6449f56a0531", "comment": "Malware payload (Mirai)", "value": "faae46bafea625a7346783f31b189ba33c114e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764554234, "uuid": "65bddf63-3240-4a43-8e11-d22c462869f4", "comment": "Malware payload (Mirai)", "value": "1ae3dc5c4d47dc08c163d0ef7a47d923075ec19111b33604541b0643f854b78935c10e461752304d3ba1d6eb78f80a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554234, "uuid": "65a584cd-6c18-4764-a917-893f34e0517b", "value": "T1BBB34BD9F643D0FAE81605302176FB37AD72E9BE2228D983D3B89E367C12641D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554234, "uuid": "69617d3b-49a2-4da8-9d14-2c9cfb2fe4b9", "value": "1536:O1z5kayPMrO/5e2xKKO1lVbDYc+Wy7w5qR6U0NhbsnxA3S6as3n0:KkMrG5e2xKKkzU7Aq0Uots2as30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764554234, "uuid": "36ec51ac-f4a4-4e95-8c0a-579eef79955d", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764554234, "uuid": "028d747c-8230-4667-8e77-244be5b5eda2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764554234, "uuid": "fb184405-b2c3-486c-bf78-c27e98a5b25a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032e38e2-ceca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764602748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602748, "uuid": "39bbfb11-6af6-4394-b870-bd9d97982bcb", "comment": "Malware payload", "value": "b33e1f40fc61f9b6386a9f73c5eacb87", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602748, "uuid": "9c9c3f15-52b1-41ae-a2fd-48a8d2790a0f", "comment": "Malware payload", "value": "7f92ce6ddf632dd49b6052f77857bd03e7e00f89965d9d6648c60773847ba6df", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602748, "uuid": "7fea0ac5-ab87-403b-9a1e-16f2b8fb59a4", "comment": "Malware payload", "value": "67bb9e694053367f2b72a5d6c2a32e7d7c2411be", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602748, "uuid": "0f768da9-5b15-438c-a893-f2001c90d9b6", "comment": "Malware payload", "value": "f0c47b989846608efc2c015ef1e76a2bd4cea1755d76733a9c3918308445118b161abd0cca0d02839bd5a773438cab5f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602748, "uuid": "9462691f-c6eb-4d1a-b94a-80496e556fd4", "value": "T1A5D0A7A6B89CCC8527DF60901083694D23BA8793CA3801B561885D456C58911C7FA1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602748, "uuid": "f9a7801c-0c01-4be5-ae28-f35ae65dd707", "value": "6:s8SMVnxV7NevE8ydH1O7kC9kO6hrupHCBtOmCr/qi:s8z9evE8ydH1OgC9kO6hcHCXYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602748, "uuid": "61781e6d-c75e-48a5-9211-a582ed34f055", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602748, "uuid": "b4cff94a-fe2b-4502-b5d9-03dc431bf6c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602748, "uuid": "42c4e4a8-0302-44fe-a262-41fd75432c02", "value": "kjard_encoded.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8e9682-cf09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764630088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630088, "uuid": "2616671b-f9e2-468e-83f4-70561caa9476", "comment": "Malware payload (Mirai)", "value": "25adef30d67888c12359e017700d54e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630088, "uuid": "64400381-be07-4bf1-ae31-7670b4e29c71", "comment": "Malware payload (Mirai)", "value": "8010bb2a004286b46c9cdb12a3f997191478ca1b77f724d91444120a03f6666f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630088, "uuid": "0610b185-d33f-4660-ab74-4324a29183e8", "comment": "Malware payload (Mirai)", "value": "1c9f9cfaeb01be0df56f11cf5ca92bb8a1fd4df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630088, "uuid": "528bb161-1b06-4ca0-8983-beaa017e46d5", "comment": "Malware payload (Mirai)", "value": "848eabd8e0b5b5addf7fe2846c2164b0197a02a94f74aba64f66efd44bce5a7379018983b78ac0debebf0de5997aea4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630088, "uuid": "5b24a437-98c0-473d-8840-b888d35d7ac9", "value": "T1E6A34AC1F98BC1FAD91B8930A1A2B23FCB31D9A941718B5DEF569F31DA33501D213299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630088, "uuid": "e6c4128d-e612-49d9-950f-edbf3cc4af11", "value": "1536:YbQO7ju/ug9NtBp9yc/XVEiv0Qhu1nWEwY6/7C0Hor8Lh3Mpm31th:YbQHTdpEc/XVl1lFY6/7C0Irq1rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630088, "uuid": "892a6c6f-9e77-49d2-84f1-ecf0dd8bbe4e", "value": 99668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630088, "uuid": "afa84c9f-6ba9-4d11-a508-dc444ca0027b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630088, "uuid": "aec6da2f-3d93-4338-ab02-3948f39b6bde", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9079bd-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608753, "uuid": "ee87cad3-d358-42c7-9fdd-f7b3a9847780", "comment": "Malware payload (Mirai)", "value": "db5c12767f66ed384497b00f633a92c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608753, "uuid": "3659ec06-9d11-404f-90b5-083a91f507fe", "comment": "Malware payload (Mirai)", "value": "8049dacd406ec4dc70ebf4c992a4c24241b71363e670e49c84362ff03bfd20a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608753, "uuid": "ca06d04f-ab3e-43bc-a9c0-21498db8b09d", "comment": "Malware payload (Mirai)", "value": "8bc0d79e73390cecc294707e4c10aadad4e9ff28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608753, "uuid": "cb42f99e-9d8a-4675-92f1-13d8379d0af7", "comment": "Malware payload (Mirai)", "value": "15bc4e5dc5056b0cf9336af903996e686f02911d7050979f50e583a2c6354ed6124a5e896d92546ce294c51603cee906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608753, "uuid": "8bec20fd-a7b6-4c93-9d4a-2c833ede6de1", "value": "T1E463951E2E228FEDF66DC7344BB74E21679823C626E1D784E29CD5001F6434E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608753, "uuid": "bd332b29-0197-44ab-a114-776276c436fd", "value": "768:kbmETwExdcropiCCYf5sZ4yvGUHiVogjNO+BblwQoI6+F8y82OHyaj7e8cIzhIxe:r4w4Yq5C4UcZO+cSEyoJe8cIzhQqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608753, "uuid": "e4af3f43-677a-4698-b8c4-4aa05fb37c9b", "value": 72612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608753, "uuid": "3c4a517f-2629-490c-b67a-ee4bad928564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608753, "uuid": "ac8542c2-9214-49b9-962d-e3692be557e8", "value": "niggah.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c25fb1b-ce6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563839, "uuid": "7aa98b21-2156-489a-96f1-7d4aa2755a16", "comment": "Malware payload (Mirai)", "value": "5877bc61bc4c5301ea0335b957bde630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563839, "uuid": "23d54e78-bb51-4d72-90d5-dc8f80ac134a", "comment": "Malware payload (Mirai)", "value": "807643c2f885f5548fa70a96825478d4bc0b8edd6e5d2caa0ff40ca6db680a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563839, "uuid": "25453ba1-565c-473c-89b6-436ef0b80ca7", "comment": "Malware payload (Mirai)", "value": "1afaf90104a920cb86b4cc65b53b32de3ba17049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563839, "uuid": "a2a9b4d6-c193-4ca3-b8c5-f790a1068220", "comment": "Malware payload (Mirai)", "value": "cfbcf49b8663db3d1dd60f5a907c34f1c7e98001ea26a3a272c0a71bd6e00d292f5d45aaabb4960ecb035a73ecdffe23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563839, "uuid": "464d01b9-5bf2-421d-b8a4-9305eee941fd", "value": "T1E6E3E70EAE358F7DFB99C23447B78E25965823C627D1C581D2ADE6011E6038F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563839, "uuid": "2093363c-d078-42ab-9fec-c01d2d7039ef", "value": "3072:jtRKxKYZt4wY6bludObqRSQ81QywJMQXb22rP/UXan1mKJ1x3C8pepHguMjDhQiQ:RRKxKYZt4wY6bludObqRSQ81QywJMQX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563839, "uuid": "252811a8-2900-45f3-ba5a-12f11dd66513", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563839, "uuid": "04ece465-92f7-461c-94a3-7a9d35e07097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563839, "uuid": "efa44570-97f6-437d-b616-3b2ea6126141", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18a6a93-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608704, "uuid": "76c8c1cc-5df5-41a8-907c-34428d735386", "comment": "Malware payload (Mirai)", "value": "ed076f0aabaf87c6c2a3dfad037ed8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608704, "uuid": "fad2e123-55cf-4b05-81c7-ebacd9e6a11f", "comment": "Malware payload (Mirai)", "value": "80bb6b65909568114e8d9064e1fabb0cde1bc94eedbe4b80c079a27b93ef6aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608704, "uuid": "d8d382ba-78e7-491f-921a-59bd1ba6a069", "comment": "Malware payload (Mirai)", "value": "f40a4a16b7ce8b6a8b84490920d196bc59513cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608704, "uuid": "e9108346-9e83-4287-9cce-f73f7b759abb", "comment": "Malware payload (Mirai)", "value": "11fdf12ff9510468e6e2ba605c2d30a21f892bf6dc15d4ec06218db490135125c22d58e277c0d86289c5af9afdca8b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608704, "uuid": "5e47e285-0283-4e3f-821d-c14ab930ffca", "value": "T1484319DAF800EC7DFC4ED73B8457080AB171E39945821A362367B967EC3A2A40977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608704, "uuid": "89714cf8-ae49-4bd1-9d30-9132ab7c3907", "value": "1536:6NYtujh9MFhs7e8p53Ggn24A+T25UXvxFZZU4E:zaqFhs7n3HA222fU4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608704, "uuid": "7e4a95ec-89f1-4fc8-a130-e4d2f51fd973", "value": 58032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608704, "uuid": "40fe60c9-03a8-446f-9f1d-931335a883a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608704, "uuid": "d81b623c-9e9d-47aa-9a4b-5d79406b7fb6", "value": "niggah.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6afcb1b-cee1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764612927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612927, "uuid": "1af54319-15a8-4b02-aad7-aadaeb3e0c7e", "comment": "Malware payload (Mirai)", "value": "bff774ef41512eb9d2d9c5d9137a1e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612927, "uuid": "c218144b-080c-4147-aff6-d9a3e03e43c9", "comment": "Malware payload (Mirai)", "value": "8129829a444c137ef5432783e5f9560693dbb9c0201f70167a3843a5f7964bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612927, "uuid": "48d48c62-7b18-4fc7-85b6-38835f6a1568", "comment": "Malware payload (Mirai)", "value": "2889cd0aef7446701b04ae27ed0fb088f928f54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612927, "uuid": "133b5c10-27dc-4d31-aae1-50e12df21438", "comment": "Malware payload (Mirai)", "value": "19a47596d37db10617f12c935595ee25e93e76280177a24ee1e06abe23f1799acdd670686bfaa2d5a2dc53d879d78bfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612927, "uuid": "d02239f0-95ce-4294-bfc7-a36196452631", "value": "T176D3A20E2E314F7DF779833587B74E21975873D622E1C689E2ACE9011E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612927, "uuid": "c2d98fa8-cd73-4e13-af02-7a51e2dd2de8", "value": "3072:EO2f3LB1et+aRNQ32gkxEzweTieABqY7VxSwLc25BkWpiAVzkp8WhrUls7or/dqf:EO2f3lAvRMMETabk8vThm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764612927, "uuid": "164918ae-fb33-431d-8178-9c95f4debffe", "value": 139148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764612927, "uuid": "a221d333-6f8a-4c5a-91cb-bfbd8f15c3c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612927, "uuid": "bdf70d46-0f88-40c0-9f27-65e54e9dcbae", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89d092a-ceb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764594945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594945, "uuid": "3272d8bc-d399-4097-8c35-81d04aafacaf", "comment": "Malware payload (Mirai)", "value": "26d3c67f93d3f037e23787de9f2f8560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594945, "uuid": "303206a9-f1f5-4509-b2d6-e2a8eacb4efc", "comment": "Malware payload (Mirai)", "value": "81330b608ad6b7464bb5d1ba1968d0b0dc4f4c0fb2eb6b202d0a361556d9e86a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594945, "uuid": "2172a85d-7149-40c0-be48-49aac4575f4d", "comment": "Malware payload (Mirai)", "value": "c5987453cec5ac0d9dcf1a3bc4b41178baa3dfc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594945, "uuid": "4ca3e16b-6974-4572-ba90-dec807cb5a8d", "comment": "Malware payload (Mirai)", "value": "6b3cd9dfd3b677975eb0f840d8a68c80537454b2d2a9371119c9c95bd908611d39d38e95175282e680562fa9b53aaa43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594945, "uuid": "1da74136-bea0-4c18-9c0c-7eb71c68907a", "value": "T19D83A54E6E628FBDF76CC73447B74E71A75923C622E1C685D2ACD2101E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594945, "uuid": "9e57b56e-c92a-40c4-aa59-462299c37758", "value": "1536:P4zsN2CCQgH3LqTvO9VyextR8qP3KBWC/J0B1awknoO89GZPIvQ:wQgHWTvO9VyOySknnZoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594945, "uuid": "f31b7e31-0ec5-4cfc-9946-d69d3526e8e0", "value": 87152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594945, "uuid": "d8f88ee9-c7fd-4fc8-88f2-8da9a9c887f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594945, "uuid": "4d5f0ef7-c5cf-4cee-a5e8-b14d4dc26e21", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74c4a24-cf09-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764630108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630108, "uuid": "51a03efe-981d-4f86-b640-5cb7b53e6171", "comment": "Malware payload", "value": "1e36adf334f710cd3dc51566d3b21e7e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630108, "uuid": "04976126-cd12-462c-87cb-2445206ba518", "comment": "Malware payload", "value": "81722dbf0c06cec0d305b28e7df8ac667b929d9a93789e7f2dd77ae8d32f0cfe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630108, "uuid": "d55d2b99-9b7c-42d9-82bb-1ec3c55cc585", "comment": "Malware payload", "value": "44e7205218c0c4ce4ffb94cfd6a5a128d09e4f65", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630108, "uuid": "560149eb-953c-4172-847c-b5c8201f5c17", "comment": "Malware payload", "value": "e399aa822842bd8bdf94518b122cdfe6d88d8910eed714e1ee69b75119b501a9719f6a685ff191875764b25b6bb079e7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630108, "uuid": "0f5fc878-4d13-49c2-b8ea-f6358e3b5009", "value": "T1B8E42940B689DEA9E9170270886AD2F31914BCB9C651614F39D8FF3FFA73648101DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630108, "uuid": "663a3238-8862-4978-91a2-d6dcc67f3991", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630108, "uuid": "6b7882e3-39b5-439a-bc90-7a3fb6a84aaf", "value": "6144:vahORKe5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWyE:viHNbURpKVuC3SdgpRBuuWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630108, "uuid": "aad9cf2b-7edd-487c-9083-1ce307fac918", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630108, "uuid": "20d9c2b4-18a1-4a88-9e23-fdc781d2e725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630108, "uuid": "b16ec628-8d7d-4598-901d-e66048d24150", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6279f9f-ce89-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764575184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575184, "uuid": "cb679929-f303-401a-910a-ea86e4c8969b", "comment": "Malware payload (RemcosRAT)", "value": "cf90c215d605c6762b23b00d100ad7ee", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575184, "uuid": "63d22039-5be8-4fcf-b454-1555705b27dc", "comment": "Malware payload (RemcosRAT)", "value": "81faf175420e3c53913e69b53918d554ac5e45220e5ae0da15308c45454f109d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575184, "uuid": "da507dea-ad9a-4711-80c8-ac49b7248f33", "comment": "Malware payload (RemcosRAT)", "value": "74463d2816dab2e560cd0881041038b04e800680", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764575184, "uuid": "746126dc-21f9-4ac3-ad91-b1940a61f15f", "comment": "Malware payload (RemcosRAT)", "value": "1bf4e8f0df001e43c4b1851d0561448b53d42406dd45f3309e459119af0a9c91f315da61576539139178a9386b852c93", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575184, "uuid": "61c5f69a-8cfd-4bf5-aeaa-bfa8f02acab6", "value": "T1180329E0E9F22935F90612E9E89885B1C3747255222748787F54B32F78363C876FD26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575184, "uuid": "7806ee4c-6996-4f78-9de8-11988931a392", "value": "768:uu4EVfutrUtpl4KcsSdRSaDAgkabqbrrI1RdBt9Sb4NBhNreJf5V:u/EctoKdSaWjkD8QhNaJBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764575184, "uuid": "74ff82f6-0716-484e-af11-8543e2dc47f0", "value": 40983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764575184, "uuid": "0b8d6924-56ac-4bf6-9a5d-89997eee895b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764575184, "uuid": "3e86a738-99a0-453c-8eae-b16372338874", "value": "BESTELLUNG BAL 5421005.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ae7651-ce86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764573949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573949, "uuid": "7fa95b4d-3fa2-4141-bc4a-f7fae277fc15", "comment": "Malware payload", "value": "2accfa4296e3d5a2c3af9b4b935dbbf7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573949, "uuid": "fa5dc5ff-5477-487d-a98e-b81834e9ec03", "comment": "Malware payload", "value": "828cab825b4d3c1bda022351d49fa3358d69684716a8fe845097c234872de3bf", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573949, "uuid": "8eed1dda-dc66-4961-8c9e-68ad4bc72794", "comment": "Malware payload", "value": "5e24e3d21052f959b7a5ac2bf405eae6bd1d05bf", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573949, "uuid": "b0965404-6ea3-4bcf-93a0-0eee1dfe77ae", "comment": "Malware payload", "value": "43c7e038cc770c280d3065b2b3064001ba307bdc6b7e36ac7b181403e30b90850e35d91ec64757f993c86d84d3af2452", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573949, "uuid": "0d951c11-a840-4378-8b52-a1a7ab7e386f", "value": "T1AB6309D2DB35A45C81E39F43102CA0F74E83C64C47EB8627DBAEEB49D0BA1447D626D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573949, "uuid": "4da3bcbd-0500-47c1-b75a-81f8a86e37d5", "value": "1536:I9l/AoSSMQ+0aNIRVtbukVrDje1FAAtyNMQ4Tbmeah/sjnovG9rGiBsD3LPhLYWP:I9l/5MgausriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764573949, "uuid": "69461718-01a9-429f-8792-af0dd26fb4ef", "value": 71984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764573949, "uuid": "d5c7af1f-705a-41b8-835d-79cf298ad241", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573949, "uuid": "96157455-de25-4835-8abf-d5f7ddf23706", "value": "invoice-1658768288.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa638cd-cf00-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764626015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626015, "uuid": "aa3fa78a-eff8-4556-8363-04ebd6919838", "comment": "Malware payload", "value": "0903640b3d85244b633c2ad7218e656b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626015, "uuid": "f611128f-d4b7-4200-8ca4-effe81487418", "comment": "Malware payload", "value": "82b68771a3ef888114aff1380140c16bffb4ffa8b054c0817f0040fad6a0321a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626015, "uuid": "cdfbf80e-44d9-4ca4-86ec-f7444f0f1fea", "comment": "Malware payload", "value": "abc223576ca68084d30404f10e97cd28efc09878", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626015, "uuid": "0a6617e8-396f-4629-94b1-89890d3721e4", "comment": "Malware payload", "value": "53f3e3d5c0527a4706af582f8304a6d7b31f53ccf8a436a58dc9fe492e2a1c38cf5ec7ba78cb046c9039822e5394a56d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626015, "uuid": "a13fafeb-ad99-498f-ab36-d85acca641f8", "value": "T174744B17F7A360FCC067D17442A7A732A971BCAC0130796E2694DE703E61E50AF7AE19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626015, "uuid": "84fcc743-217a-46f8-85ae-2dd1b3d40e7c", "value": "72cfa443e310d722c47455c748d12e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626015, "uuid": "f80e97f4-ed40-405b-98d3-d42d152ca236", "value": "6144:MTc2vX/pFDvf+wmvqO/PvrezM8134LUkaF/8Cl:Mc2//Lvf+BmEmFtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764626015, "uuid": "6092aad0-14d8-43dd-8689-1667d0ebb45f", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764626015, "uuid": "4ad5fa96-55e3-4e16-bb44-61e43d88fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626015, "uuid": "47bad007-ebb9-41f6-9b7a-cf461bc188e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffa738b-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547471, "uuid": "2afff5bf-ac8c-40b4-ad74-ed8cbdcbc874", "comment": "Malware payload (Mirai)", "value": "24eb9801c6aa9ba6e27b076ef6d0049b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547471, "uuid": "d8196618-6ef0-4ad3-955b-d72f1c370fbc", "comment": "Malware payload (Mirai)", "value": "82ecb1386c7886fb5eb036a57b9a5de5c33666a4661d34a4fa21e18ce46973ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547471, "uuid": "3de7b4e9-d567-4f8f-81ee-e6e6fc7bbd63", "comment": "Malware payload (Mirai)", "value": "91d7fa1c616d98537bf1ba6fc19614990085464d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547471, "uuid": "42ee7f18-a5f3-419a-a27b-f9d3c402b308", "comment": "Malware payload (Mirai)", "value": "d752eaf27b847da7f25d6f3ab160cd843271c75856208c6dd284c3bf1f237a5a0f23e4fcd4bec31dbdbea8c527851bcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547471, "uuid": "fe2d83c8-8193-4df8-a974-d7c09da0c371", "value": "T192D2E16A27457CA1D310DC7ACF7D94C22E9CBEF8CBAA491226A42F74C80C40D65FD287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547471, "uuid": "c1c4b344-3d94-41ab-bfe6-7115d8944486", "value": "768:DSqEkxgmuaN5QRrY3W0zcxLmAIr6dBts3Uoz+aC:DS1CuaQRrYjzqy6bwzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547471, "uuid": "e6d70bcf-c8e1-4422-b773-94bc99790c7d", "value": 30984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547471, "uuid": "4683216f-4ed1-4382-805b-d12fd88dfcbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547471, "uuid": "dc9ad730-f27d-4219-bca1-031bbb1a111e", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417e329d-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764590826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590826, "uuid": "95e0c55b-1845-4172-b915-4400cd3cbae7", "comment": "Malware payload", "value": "58983f93823c960a518af0c429b3a4df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590826, "uuid": "e6d654a5-0129-4b03-8d66-694e01350450", "comment": "Malware payload", "value": "8309a091cb7b8cdf496b696c7c0dd407e8c90bc1e9735c6845c9dc675506c5b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590826, "uuid": "2a49dfa3-98fa-4086-9bb4-4bedc141c853", "comment": "Malware payload", "value": "d249b7776798a368e27d9e9ee967a87e1f0a53b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590826, "uuid": "0c4a02e5-8b38-45cd-b663-e60d17b9139d", "comment": "Malware payload", "value": "e68ce5bb62063c9d11f9e39fd56f9019b47d00fc62c7151889991b8653dc0a5229407da6a1d0e92163b3931b2fa4974a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590826, "uuid": "6f5c7eff-e0c7-40e4-8e3d-e8c9ad1ef483", "value": "T160157C74B6615A7BF6CCCB34B2A18C1457F25118A93FFB0EA4DE44D0E6B17CAC81960B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590826, "uuid": "e47da9fe-1f9f-4aa4-9378-346472c6f787", "value": "12288:NHjKMBSVMcmepGizsKx8D6Ify4wgKWhhePHlXVSpOPr2xAWJctNN:NHjK/aizBUFtKche/lIpwimZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590826, "uuid": "13df177e-7b81-4617-8848-e0803d30badc", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590826, "uuid": "2acee96d-c390-450c-9747-8a36e142d2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590826, "uuid": "f416e3e5-202e-4137-9aa7-4a5ce0fdfb0d", "value": "security.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8c8c89-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764584216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584216, "uuid": "83f3f208-2bf4-412d-a797-49a4a1ba477a", "comment": "Malware payload (NetSupport)", "value": "307c4d6d70251c0989cbab3069fd1f2f", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584216, "uuid": "24bcbbf2-efe6-4d8e-b0d5-4ef605bef12f", "comment": "Malware payload (NetSupport)", "value": "837ef70956e401d904b1931e335abae64a74572b13f3123c963fd8d40921d119", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584216, "uuid": "ed61a545-c1bb-4566-b796-92276ab04509", "comment": "Malware payload (NetSupport)", "value": "3609cde0935b96402fc7ebc16e811d61a23ced66", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584216, "uuid": "6d93102f-e9d8-48a1-886d-760f80b8c702", "comment": "Malware payload (NetSupport)", "value": "fad31d805400f1619e3958bef087a7e9714d191d9fb3ff9b9e48718525711846959ac27bca3fc771dfc0a7db600a0436", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jkwj238llwekdl-com", "colour": "#51A768", "exportable": true, "hide_tag": false }, { "name": "kjrkwjednjendwjedkwejdw-com", "colour": "#899981", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584216, "uuid": "c87b4b8b-a235-4236-b86b-7ef49c83d754", "value": "T160A2E034AB7CE6A6E75D06F3B7DA794C8FFC10685681428AE88CFD01164FB9F101A178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584216, "uuid": "d90317e4-d6fe-4e00-8ce4-cd3fe16606b4", "value": "384:EXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5NFV:EXKuqXS69Szi/urdMt5lBUeuhJrsRxLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584216, "uuid": "966fe304-2351-4e6a-945f-cc4c6f5cd66c", "value": 22172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584216, "uuid": "25eba170-a58a-4d4a-8be7-bee38fcce7ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584216, "uuid": "ab981139-9ea7-4c18-97e3-e84f4326966b", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e6e835-cee6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764615152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615152, "uuid": "422905d3-69db-4897-9f14-d891243a5851", "comment": "Malware payload (Mirai)", "value": "d5ebff0cc52cbb5141c7dc63262fbd03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615152, "uuid": "da097b8a-827c-4ad1-bf02-7d409809fa2c", "comment": "Malware payload (Mirai)", "value": "8561c9d0647f394dfa55f1217fa3da02576cfcbd9a7d442fb81479f6dad379b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615152, "uuid": "d4a36302-bd42-4998-b2cc-5527442b4549", "comment": "Malware payload (Mirai)", "value": "33d6d5e80aa0cc2af77cdbf4dab5bb8c564f89ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615152, "uuid": "0c925f95-f1a4-4629-8cfe-9a52a98ef255", "comment": "Malware payload (Mirai)", "value": "6fff96b2f6bebbad2c71306f64ac6e63a575493e414b911ae738c52ed4ca0e4f8c77b4df439b96ea9abf5608d884b1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615152, "uuid": "82e71192-e690-4a7f-8e80-ec1c2b154fca", "value": "T166C3D90D3F219FBCF7A8923507B78E259259338A37E1D181E15CDA016EA038E645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615152, "uuid": "c823ebaa-f60d-4b61-8567-4701f615030c", "value": "3072:bcDXnKTd4uDXvfKgEU6LWmkcpffytWd0Fr8XB:bcDXnKTd4YXvfp7JmtpHrOsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764615152, "uuid": "44feedd9-13bc-45f5-a3e3-814ebfe70652", "value": 126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764615152, "uuid": "d19dc507-16f8-4d5a-92c4-44010f5e0243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615152, "uuid": "ce927bce-1f30-41a0-98b6-918a3147ead7", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eaa385-ceb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764592474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592474, "uuid": "cd69ecba-4f04-40a3-8684-ad5c91dc128e", "comment": "Malware payload (Mirai)", "value": "195d056f4db741c8cf6c7bc3764bcd20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592474, "uuid": "cadc0a97-2a65-4d7f-804c-2fc94d09411a", "comment": "Malware payload (Mirai)", "value": "8562260a9835de79d39e5b7ef2096cd8fc671362cf23a0dadc81f1350597f3f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592474, "uuid": "8fa6c918-3ef2-4443-a6c9-17420fef6e90", "comment": "Malware payload (Mirai)", "value": "ff5eafeecedd3330462290460c1a14027f5e9a3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592474, "uuid": "b99fd590-b80d-442a-8bae-6cb737e72cf0", "comment": "Malware payload (Mirai)", "value": "4020d9746af4887623f3077dfa53e24b70d873db8da5f11d45010372c0748946369560ab7239975f4f92d0f3946821fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592474, "uuid": "5e92265f-b91f-47d4-acac-1ec60b59c852", "value": "T12B13F125F46C35D0DFBE7F271C19EBC1A39B2AD5D2BCCEB30AA4870019617A192116E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592474, "uuid": "d2a8368b-a93c-45e6-b3fb-0c9495ee1630", "value": "768:wnlKSSUz9FzPQwoODqeGyfe3ZLMaVe1vQEdsW7vi5OGMl+4uVcqgw094:wnXLzdRDoySZRc1Pds6vi5OGF4u+qgwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764592474, "uuid": "c64d441f-bc32-4da5-9654-a5a48c777d25", "value": 45500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764592474, "uuid": "129daafa-ec2a-4c31-b95c-cff3c84ff932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592474, "uuid": "c68c7424-1912-4654-bb84-31309dae466d", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4235d415-cf0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764630771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630771, "uuid": "dde1dbae-1e78-4727-a90e-27e76eeac371", "comment": "Malware payload (Mirai)", "value": "5704d2523b41fda3960987e3236ca41b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630771, "uuid": "19cea19a-bd30-495c-a72e-51f212949ad6", "comment": "Malware payload (Mirai)", "value": "856720566c0be471eb52f05d34b5cb1efb87e4d58f0fc6419a0d7d844bf1e9d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630771, "uuid": "bfd182b7-a5e6-4076-810b-f3f812bfbfc9", "comment": "Malware payload (Mirai)", "value": "caa13c92b0a0e51556fc4fdfc8ebbd537084adbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630771, "uuid": "ebd8707a-a83b-4735-9c8b-4c62ce1a1b8b", "comment": "Malware payload (Mirai)", "value": "1fcb381edca5ab47a4630c0daa003bad9e034e83060fac6601ca0e22e1e5dac17ec914826f54adba8b258e78d78db22a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630771, "uuid": "a79a5e02-6913-4446-8c0f-d5eed716cb42", "value": "T1CF23E10D51B47B4DCDAE7CB8C0852BA6AD14B19826EA178C5B000C48EF5EDCFF55A878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630771, "uuid": "08bfd9f7-3ad7-4f86-b6bc-0468e3745043", "value": "768:+7SSwN6vwVq6YUJqxo7AGG7JtEw4U6j/eI4ubLWeiq4apWRqOixXWo:+7SSHIw6o/JtEw/MerRqNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630771, "uuid": "d014e1ca-49a8-4982-b099-b5088c7901b2", "value": 45900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630771, "uuid": "ae8d7cad-3886-47b9-8ea1-aced1a044d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630771, "uuid": "196fc738-531c-4a90-927a-03650f7d36e8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a91fd5c-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764602062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602062, "uuid": "200f738f-a766-4d45-97e6-981ad7cb7b36", "comment": "Malware payload (Loki)", "value": "c83a108ce91ea36043fbd79841c2d6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602062, "uuid": "b519a99f-fb8a-4af8-9f9a-7e8d41869e70", "comment": "Malware payload (Loki)", "value": "87074659e5cfae42bb2b9e475b95d9c5d729d298ac80be029f3453b853aa0cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602062, "uuid": "cab4b36d-6486-43ff-9bcf-7470fe57c1e9", "comment": "Malware payload (Loki)", "value": "11f4da0c5a9b5923e7254404e52c8f81157a32f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602062, "uuid": "eb0e674e-9306-45ed-bea4-712c0251abfc", "comment": "Malware payload (Loki)", "value": "d220a55b77d50d5f4e59bd22e6cb83ce91c95d14849450d5bc28f02c7179f6b80e630376b8a12bf51ec44062c26676d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602062, "uuid": "3fa64844-7283-43cf-80d5-16a319157171", "value": "T100259E0273C1D062FFAB92734F5AF6115BBC79260123A62F13981D7AB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602062, "uuid": "653f5e2a-6d6a-4392-a373-2fd22ca7555b", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602062, "uuid": "c3a6f8f3-0719-45ab-9a86-6e86ac8248c2", "value": "24576:65EmXFtKaL4/oFe5T9yyXYfP1MAXDz/a0Ci1RJe:6PVt/LZeJbInGiz/aKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602062, "uuid": "017fe3a3-d1a9-4840-9468-798f22459b58", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602062, "uuid": "03128132-c61c-4fd5-81bb-773c5196b251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602062, "uuid": "c4901e83-6b6d-494f-8ac5-56c4fa658dad", "value": "LKJ876543456780009800000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40a972e-ced1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764606051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606051, "uuid": "2d1e7cbb-7cc5-48d3-a4b2-39beefe582c5", "comment": "Malware payload (AgentTesla)", "value": "c2cf250459b71e67cb17349df6165e9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606051, "uuid": "38f4c38e-a25d-4735-90a9-75f2e528574e", "comment": "Malware payload (AgentTesla)", "value": "87c9b23d3ac3e48910f9d204708f95d337fab4161b5fc8a9a32735cfe7b8d83d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606051, "uuid": "a5c07e7e-415e-4d82-ad84-80e6537e9622", "comment": "Malware payload (AgentTesla)", "value": "79011302c59a57791c53da80fe41c685883a870a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606051, "uuid": "7528663e-6dfc-4da6-8aab-1b1243836886", "comment": "Malware payload (AgentTesla)", "value": "755257cfcf40d06396737f988bbdf7e7637f2a7074fffbef7f63a3117d76aea58017ca111b419c84352d34e8b51fe09a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606051, "uuid": "1f02bcbe-8aea-472c-8c2e-76352074fe97", "value": "T1A3E402631D98D743E4A063F62873CA782B693F4DA062E39F0BEA4CCFB5253194D89355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606051, "uuid": "3ba6f438-d411-4db4-9011-5b67d035febc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606051, "uuid": "ea64f00c-dac5-47cb-a7a0-f28c688433d7", "value": "12288:m9xHC/KLQwtj2ry59AC5SrLjun4YvWg2IXg6tE+2Yel7EawMOt8:mDC/WZar62LgWSXg66ZYelg1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764606051, "uuid": "6fb27400-5522-4905-a29d-64b0b1ba2533", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764606051, "uuid": "9779c95f-85aa-4dc4-a312-58179dcbdfbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606051, "uuid": "bb621de0-4644-477d-8926-827f865dd574", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.27126.2315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2004f351-ce53-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764551686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551686, "uuid": "7326194e-6a0c-4414-a71d-7e7bcd4bf984", "comment": "Malware payload (AsyncRAT)", "value": "22211c7e12b24b26d969b08e506c1cae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551686, "uuid": "2bb9affa-c9a5-4733-8190-56caf91df01e", "comment": "Malware payload (AsyncRAT)", "value": "87ffe7535f7e221d713ce338cb8f1ad3481c6a1a48932203f1658d6a1cd1c201", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551686, "uuid": "03c98040-31f8-4e5b-b824-0cf65273f265", "comment": "Malware payload (AsyncRAT)", "value": "8b63906e135f36c787c90f121e9cdddf7476ff1e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551686, "uuid": "059434dd-5832-4ea0-b4e8-3652c00b9481", "comment": "Malware payload (AsyncRAT)", "value": "698ee426f97f42a3ebb6b604d85eb64895814015299ce692b9830663249e0374f841ef6ac811455b53b53f8c2ca59a15", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551686, "uuid": "78e9e9fc-6aa9-49d5-bb07-791e99c5e310", "value": "T12FF23A09F7904255D9EEAFF16DB361090235E607D923EB5E0CE884DA2F27AC0CD527E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551686, "uuid": "31d2082a-832d-462d-bbf9-fa22713d4860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551686, "uuid": "553bf19a-f4f1-4d08-9b83-d090b866b5ce", "value": "768:RCi+xDG2sVXxkU7gEVfFp9jdIOjhq/Wr:R1+xDG2qzlBFp9jdIOjser", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764551686, "uuid": "c39f76be-3f0c-41e3-bb54-4b3c7a263661", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764551686, "uuid": "5e7e3cdc-b7cd-43c9-8151-37abc2a74317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551686, "uuid": "adec0e0e-8d72-4b56-8982-ba63cde59054", "value": "hjh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569ce3b5-cf07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764629087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629087, "uuid": "dbaeca77-8dac-46b7-8c24-c9f7daff9d8f", "comment": "Malware payload (Mirai)", "value": "e299642e6adc3887bbf4e4177046a82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629087, "uuid": "5f1aa859-12cc-4c88-8792-5c68b254620c", "comment": "Malware payload (Mirai)", "value": "88cb9debd831d428fa316f2bf7fc6129b4cacc317b2aee14c0ba0cde70459b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629087, "uuid": "06158ecb-30ba-4d51-aa93-3c4a6ab49295", "comment": "Malware payload (Mirai)", "value": "972d88be4f29d5a24e3bf1bc47566a11bc09e298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629087, "uuid": "1c39429a-90a0-4b27-9cb8-462c55a20999", "comment": "Malware payload (Mirai)", "value": "a20eb685babfc2a167fe9362f6b6abfb1dfe49266138dbb37af6995759c09ec45ad6ad8da61495bb5203ec55573f79d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629087, "uuid": "f62a0295-e7eb-4bfb-abb0-5313bd5d6830", "value": "T14AC3AE97F7472491CC760BF007C78B9D2A632112DEAFE8E76C1E667B157A0EB1906390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629087, "uuid": "3cc3413b-9745-4995-b892-e046528cd3d3", "value": "1536:5JYMWaPz5BWSPg9Ax++/LDeesvskPOlSifD6G6xpIfgUdx/LWL:5JYjaPvWSs+/HZw7POVfD6Ig+xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764629087, "uuid": "bcb1a489-e863-467a-b72b-f25cf445a7da", "value": 124404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764629087, "uuid": "e9c1e8ed-33f3-4db5-a669-1d1ac68f0e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629087, "uuid": "dc441238-e782-4bf0-9cf9-3890ce85c08a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f46b43-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608713, "uuid": "f57303d2-951e-4c9a-a321-2e6e13b5f6c1", "comment": "Malware payload (Mirai)", "value": "0e428e766b80eae0dba99707396e1085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608713, "uuid": "94576ce9-cbb5-47d6-8f18-24ec5a17c45a", "comment": "Malware payload (Mirai)", "value": "89911637200984dd3b08ed863b3793187edec11b333ff87cd521b141cf2efaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608713, "uuid": "865d67b0-91d2-4b69-8ca0-b405d662730b", "comment": "Malware payload (Mirai)", "value": "8f37047bce1701c67ad49683ab9cc7adcfca8206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608713, "uuid": "4a3017ba-7d17-48e3-a449-3a2f1abce0ee", "comment": "Malware payload (Mirai)", "value": "1bf51ba91b3383ecc1828212b6c506f718835e7758a235b20f418c59bac5dba04361367b56bb503d4d7106af6f9d4959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608713, "uuid": "b52eb08e-b77c-4193-8c98-3430a014fa8c", "value": "T113C2D03043156A72C1B15D3DDEDBEB8376A74B7E91F13230233041B4B98B4422AE96F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608713, "uuid": "4e1a692d-5a43-4f9b-af6d-ada36bd04c85", "value": "384:oevIj2O74JaeCzIn5dEQ4aFYYcYuZUfYUL9U1oapNS1CdAhymdGUop5hb:m9wmuaQRFeYuZUfFBEY1CdAs3Uozh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608713, "uuid": "7b05449f-f0c5-4bdb-acac-bb1d1470270e", "value": 26788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608713, "uuid": "2baebd53-13d0-4e25-85a0-f3f18bfcc920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608713, "uuid": "7b8e9c5f-aa64-4e42-9460-76f60ee50dc7", "value": "niggah.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab67301-ceb3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764593231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593231, "uuid": "4e0035d3-aed7-4c27-ad87-3102d6660e7c", "comment": "Malware payload (Mirai)", "value": "9c3c0eee504a280197be11c833e2d0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593231, "uuid": "513909d8-e58a-43e7-8364-290a974aa069", "comment": "Malware payload (Mirai)", "value": "899181b984d763d03e4149a899b98bfffa8d2491a9b5be8395425ec6a0c620a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593231, "uuid": "5779b400-d93a-4c54-816d-6f424092b0a8", "comment": "Malware payload (Mirai)", "value": "54a3a9e96a040205dbf83d887cc710edcf0be0ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593231, "uuid": "3369ad02-7adb-4002-8472-1ea6e66facc0", "comment": "Malware payload (Mirai)", "value": "0a142812e9e02be5d77a470787a07d3320f08189d1179c1ac26c29dfd23fe5eba598eb30c34377ae43bb5ff0b81dec87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593231, "uuid": "cf0c6c1a-24f9-4f14-afc3-a69ace961096", "value": "T1A8D2D0262285AE91D320CD31DB7ED1C732EC79F4C797102722609FBAE80D46DA6FC242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593231, "uuid": "ea20a229-f503-47fa-8d91-23b681b90b79", "value": "384:EjSxCpJEkHnbv/1hYi2Hy8mCNPtEN5ZiRAVwaV3bDjTirRQ76k1apYMlThymdGUn:YSqEkxgmuaN5QRrY3//iCpqTs3Uoz+am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764593231, "uuid": "3f00fbb0-c5c1-4952-8eed-eaa5491e1a85", "value": 30968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764593231, "uuid": "fe7766ba-fb19-4cca-8334-c942fd7de3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593231, "uuid": "4c0ce5a9-1fb1-4e83-813e-bb3b36b507e9", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff048872-ce72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565374, "uuid": "97c2333d-d514-4c91-86ff-c55438123270", "comment": "Malware payload (Mirai)", "value": "28dc46339ac1ffee597f8b098a48368a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565374, "uuid": "c0acc4d0-6677-4934-a084-f33de9d117ad", "comment": "Malware payload (Mirai)", "value": "8a68320f5250284c80c5c0a42e3fb6aba1ca0130bab0e2b7220236ec01ba5416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565374, "uuid": "3552fccf-95a7-4691-aa24-77c860f32901", "comment": "Malware payload (Mirai)", "value": "373af0f349b7f43b0f0aff5737b665a4539ef90e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565374, "uuid": "b8d0f5d5-1450-4dfd-9c7d-673bb0386e05", "comment": "Malware payload (Mirai)", "value": "cb77e1f33df9ca4bf02e819bad5d00e8759f0dd879f7fb853ea8ac2faae653b310f87689e60ec372421f146c95cd1013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565374, "uuid": "dc1230a7-b938-467f-a872-407fac21cfe1", "value": "T1A9F3C50E6E198F7CF79987344BB79E32925833872AE1C586E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565374, "uuid": "72f13b22-6b84-4e43-965f-7d8c980c94ad", "value": "3072:ZOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4TqEQTXfT0pmVDFu:ZOATXjpCgqDJHDexBJKfjPV4kuMu8hJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565374, "uuid": "a9b803b4-0656-4af7-bc9c-ece0cefa5b7d", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565374, "uuid": "03bb11b7-00e1-4f37-9d7e-6e8ded97db69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565374, "uuid": "199dc7a0-8a94-4bdc-b7c5-2ad5c44c2570", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59d0160-cf07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764629327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629327, "uuid": "02e31c58-ed7f-4c83-9622-8c7cfff8be01", "comment": "Malware payload (Mirai)", "value": "2e51c7340d325d56455e1c539b466b63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629327, "uuid": "c0d1c6d7-112f-44d1-858d-4d3c32e0fcb8", "comment": "Malware payload (Mirai)", "value": "8a949083b0d6567f57fef5b4e6b4ae5aa205b38a3cc5df1221f9b9b8b8e6a869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629327, "uuid": "fd98dfdb-b26f-4419-b8c1-25b450d12f1e", "comment": "Malware payload (Mirai)", "value": "0f52054e32b1fc12c4c71adaadb06da6ab712a5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764629327, "uuid": "66656ec5-80ba-45c2-8046-aff88628f034", "comment": "Malware payload (Mirai)", "value": "13eb088b223a0530c1931e9707aa8167f0b6260a625d9fcf7e24766db7078bcbfe4ae69f43f232bc76a971422f51ae8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629327, "uuid": "62a6d823-1672-42a2-9beb-11bbdfa09299", "value": "T13CD30646BF210FF7EC5FCD370AEA1705248C991A22E97B35B530C828F69B25B15E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629327, "uuid": "9de58935-b87e-48c4-9b01-baf1d1381340", "value": "1536:wyNqViP5Y6IeeremuWpdg3DtHKjrOrmJl7hq6WVTZ6bMtmKNQtR:wydY66remuWpdgztCwz6yTLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764629327, "uuid": "9bd4df43-1c67-466a-a0a8-0e77eed2071e", "value": 130240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764629327, "uuid": "d62b1d4f-ab25-4134-bc63-44151929eed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764629327, "uuid": "f0f53e78-24a0-411b-a010-0630ecc07ccf", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb68743-ce6d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764562846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562846, "uuid": "268195e4-f68d-4245-bbef-99bb33db5e43", "comment": "Malware payload", "value": "65bc877ca01346c85575ec60c785e3ed", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562846, "uuid": "64aa391e-8422-4957-97d3-bdf4cdc38908", "comment": "Malware payload", "value": "8be232b107dfbbc60516223020661e772cce863c59193c50d15e25cf85962816", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562846, "uuid": "ce3f3107-cf42-4ed8-8c6d-14534c4b9295", "comment": "Malware payload", "value": "094f14b419e427bcf5b940460b5f906e536afef7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562846, "uuid": "aa60f873-4816-445a-bd5f-c9ba9ebcfdf8", "comment": "Malware payload", "value": "284360f02eba252482a1d1ed4dc7efbdf031d77b0ef6fec42e18a9257e08b3dd65160a732a6d60c8e8f0bd3875485c66", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562846, "uuid": "297d0f6c-f992-4272-aff6-b08d18132dd4", "value": "T1B473234909EB44FC9637B854CADF4C06FBF98513161CCAB1FA9DB6D02F0162862F96E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562846, "uuid": "a8ad5b84-797d-4041-b0e8-cd7cd21107bb", "value": "768:k5eP3zQPpN+CX13/XbgYerRJeWaCqj9OqGMd5K6bBZTcBSmm3myYqwN3jytUl2UE:ksP61jta6MLF4W85/kmmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764562846, "uuid": "6e5e0c54-dfb8-4223-9bf0-42e8ae678eb5", "value": 76435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764562846, "uuid": "5bcc16db-91e3-49ec-bfe2-4bb5e16b0bc0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562846, "uuid": "aae5a084-399d-4941-8fe9-157fcd392e9a", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cbe161-ceab-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764589847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589847, "uuid": "f7a7e887-cdc2-40b6-80f6-0a0a304bef1e", "comment": "Malware payload (AgentTesla)", "value": "0839f8fa2031f59ef2653191a30f982f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589847, "uuid": "9856bd4b-fc26-458f-a21e-90818c9a8787", "comment": "Malware payload (AgentTesla)", "value": "8c14b765e8ecbe82f756ec0a78350d4c51ec083878978c61d7c78bca434dae3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589847, "uuid": "e5c906a7-6a6b-4ca3-b451-983483c76432", "comment": "Malware payload (AgentTesla)", "value": "a7b331750d1e865acf80acbaa1f6def8fd6ff2fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589847, "uuid": "fa136dd2-c3b2-4df7-9497-9ed8096ad295", "comment": "Malware payload (AgentTesla)", "value": "653eae8de1b1c8aecf594c8774984cdb9ae4657293fb456e618b1b87cda57ce1b872c97970e1f4b68d27b2dbf06025e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589847, "uuid": "49365f43-d152-4df5-9912-8366a557b01d", "value": "T1474502154DC82FB9DFAC591890BE160EE3F04A9F806A6989FF3BBD466FF7640410E185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589847, "uuid": "b970b3c4-b3b2-42d1-9162-4ac11eb5af7c", "value": "24576:J//p9n9Xa3kFWQodYwl0gBTQIB9HXIEVD:JJOUYZaZYTFXIGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589847, "uuid": "54f9840d-f42d-4d68-8e75-2f55e2ecb35a", "value": 1244348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589847, "uuid": "9ea1e4a6-efef-4234-abcf-e480a1509316", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589847, "uuid": "4c50c640-b71f-460c-877d-e713b245c58e", "value": "OFFERTA 2625.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea21c28-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568917, "uuid": "bce1cf38-39bf-4412-9e76-71b8e39a2573", "comment": "Malware payload (Mirai)", "value": "88a03c90fb7b3f8fa10c976fad1e3c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568917, "uuid": "d9f1caf3-4231-4270-aa20-9df775a6bfe1", "comment": "Malware payload (Mirai)", "value": "8cba315c20adaa037340944297cdfcf929a6fe3fb22e1de7a11f43d6ec4328c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568917, "uuid": "d449049c-0660-4930-8b74-501d4ea3463d", "comment": "Malware payload (Mirai)", "value": "e8bf347ead4b31b1a70ec83ec5c9f86b212750e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568917, "uuid": "9daeb8b9-4639-4348-9d49-b92cef9f24c0", "comment": "Malware payload (Mirai)", "value": "1de6389611c3263a87f01d4906fb99ea82401216a7a1d83fecc7c4f39a3a19d053486113121e4a42da69a6de63f8a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568917, "uuid": "6ee23f9d-4a10-4455-b960-09d82453749a", "value": "T19D23F143E8EC55D1EA9F00315C8F7E2B3C00942C8BAF89A76A04649D7ADFF4116D4B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568917, "uuid": "3457a1f9-67b6-475b-b73d-3e9a8bd25b54", "value": "768:LZ+A1ENhFI6vR8IxA5w777EIbaFTC7pgh5gP+vUbCAf5m5CgPZDchYwHWtnbcuyG:N+A1OR8Ixbv7EKpyi++hmP5iMnouy8HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568917, "uuid": "b80da87c-06fd-4036-8eb8-d1e5b1a91a56", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568917, "uuid": "ec3cabff-2d0d-4db5-9b8c-d93c39f44ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568917, "uuid": "8a8e38f4-06a7-48bc-9514-2035dd27d404", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bae2f1-ce72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565124, "uuid": "8648bb11-bf6d-4aa4-921f-81efca85c0b9", "comment": "Malware payload (Mirai)", "value": "e72fbbe6906052e1d8f3546644602849", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565124, "uuid": "bd45cb84-f4a0-4dae-88c0-a575bc4db693", "comment": "Malware payload (Mirai)", "value": "8cc4dbecbbd2d5dcd4722a63b936a694893aefa99db815284117a325d19f2fdc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565124, "uuid": "77afdb36-c89c-4e0d-ba32-9b6d13e54068", "comment": "Malware payload (Mirai)", "value": "2d01b4cbe64b54699ff6e120f172c6d85a4debc3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565124, "uuid": "cfba8eaf-6d8c-4438-9eab-54a54734d99c", "comment": "Malware payload (Mirai)", "value": "0d8bded931971bd296378ad77868657ac6920d22247a0f0bfcd5bc7b0f2d159165b22437a62959e893bd57560aa4fd92", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565124, "uuid": "08ad673b-197c-4be0-9e25-507cf76adeb4", "value": "T13B11A5EF0151145A2540FE99BBA3CA29B08DE5CB2CD68F5C6CED0C3510AB91DF815FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565124, "uuid": "97c35265-97a0-4bba-bb73-0a44d64e47bd", "value": "24:tfYZIBWvHkHOWvzzMzzGWvRnRhWv0IBWvGUWvYDY6WG:tfYZIBWvEuWvkOWv17WvHBWvGUWvYDYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565124, "uuid": "01b2d6f9-d08c-4991-a0cf-fb8db5ed5ff9", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565124, "uuid": "7a90d0e3-9576-4c0b-af03-4c1ccd916ac0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565124, "uuid": "1ebf0e7b-d677-41ec-b01b-d44ab38d61b1", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f586c7-ce4b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764548575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548575, "uuid": "5d880921-f831-4156-b362-e21031a15d81", "comment": "Malware payload (Mirai)", "value": "34c51dff08cfc69c2528b6c6ef075c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548575, "uuid": "be4725c8-8ed9-4216-acf6-9bac86c6d885", "comment": "Malware payload (Mirai)", "value": "8d6aa9b66bbdecd40feda9bb35502118054db1588f535f1e8a376ad0ae2ac5dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548575, "uuid": "f4688931-bb2a-42ca-936b-503ee9de167d", "comment": "Malware payload (Mirai)", "value": "ab2d62860ee13aa7535a8b6ed90496fd827c802f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548575, "uuid": "034dd3f4-cf64-433c-b354-7b067b963b65", "comment": "Malware payload (Mirai)", "value": "54a531b974be229c9c4917a511ba0b38c8f0312010cbdfa05cd6865f726db9ca0ea053b295454772db12d12c0ee2c68f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548575, "uuid": "37380c85-752b-4883-91f2-ec3576cb9758", "value": "T1E2C39D73E42A6DD4C0A44534E4B5EE751F72A5C041421EBB2AD5C5BD04C3EA8FA0AFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548575, "uuid": "f9d80a40-3573-4377-9468-f8656d7e147a", "value": "1536:ha/bsx5XDVu5sZwtLui/ShlFtL/TSO5x5KZGp+Bk3N1HCQVKZrX0FybnELr1wHWm:hCQZZBIuiIb/TT4Bk3WXZsybEV2Wj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764548575, "uuid": "8f0ee6c6-1204-4401-86f1-5aefa8405c37", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764548575, "uuid": "9367f1f8-2722-4503-80d8-4f5dfe6a8fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548575, "uuid": "f920f107-4418-45b5-ac3f-61d9f3e2f3f1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472e7778-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623048, "uuid": "46895ea9-b3fd-494f-8460-36080bcca461", "comment": "Malware payload", "value": "42b59f498fa94553ac450c0681ea24a7", "object_relation": "md5", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623048, "uuid": "389f2a4c-b5b3-4207-8a05-30c1196e322c", "comment": "Malware payload", "value": "8dff060f8259763780ce4145b8520243014f2ddb4f6ec2accc3684e4efb234c8", "object_relation": "sha256", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623048, "uuid": "c97eeed3-6ebc-4dd9-95a5-0206658d3bdd", "comment": "Malware payload", "value": "cab7fbcadb47223d4290a1bd24c8722700764dcf", "object_relation": "sha1", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623048, "uuid": "1666151d-3cdd-41cc-8f35-a438f53029d1", "comment": "Malware payload", "value": "df536e135405466590219131b1923555c3e159873078a78e059ae0062443d036ae25b56481b81707d2b9b119a28d2018", "object_relation": "sha3-384", "Tag": [ { "name": "45-155-69-224", "colour": "#8993AD", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623048, "uuid": "73bf4836-f114-4359-bbe7-01bfb2ae142c", "value": "T175963322997D4F21E66FF2305921ED1BB25F8344B28038AF8A5EC1916D139BD3B2D41F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623048, "uuid": "f3242640-611f-4db7-9fc4-3490be427b9a", "value": "196608:uxAKj5KiiRW8zWuBLBn0VeMsxdbjgOXHEEAYBEo5sjp7:uxAKVIzWSV0VZadbjg4Qop5ip7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623048, "uuid": "8862f88d-5523-4697-868c-706438366644", "value": 8867189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623048, "uuid": "4e9f5fa1-63f2-426f-b461-53095fcf9d20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623048, "uuid": "323bf4f1-c4d0-409c-bffa-349200bdf712", "value": "crashreporter.md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a95e12-ceb4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764593299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593299, "uuid": "20a08ad5-9147-4940-b28b-a84d78dafd55", "comment": "Malware payload (Mirai)", "value": "3399cd3ac70f35e20d7627982ba7f689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593299, "uuid": "685331b3-5f06-40b6-a449-5366ef338c51", "comment": "Malware payload (Mirai)", "value": "8e62d1328d34a535c10e7158182899efc17d435e2be57a5a81e17fb64bb167f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593299, "uuid": "9a361100-4311-4d63-81ea-5f32596d08c7", "comment": "Malware payload (Mirai)", "value": "8e8b026c0983678e51d58df814adbb717424c71a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764593299, "uuid": "144a15a4-c84f-4db4-a1cc-c7ffd92aa095", "comment": "Malware payload (Mirai)", "value": "77f1ba09a0f9adcc44d4810f65ac3bb0ce447ee5945109a3a5a107ba86e5d1c03a2c0ef6a35f3a1df2b5b26a81d53113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593299, "uuid": "e3e95ad3-8d0c-42a8-8be3-8e0ff5eaa363", "value": "T1BE830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593299, "uuid": "6da2b38c-85b6-4243-8768-6cce89597621", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFOVOCHFmKgAHCe:EPmBcPJUqiBlV34OVOCt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764593299, "uuid": "b7c4cc69-fa27-40f0-9db4-7a0fa1d7025d", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764593299, "uuid": "1e6ba3b6-26a7-4ba8-9d18-2acfee75281a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764593299, "uuid": "8dcba9e9-af92-4aa8-bccc-bf4c749b4c5b", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8599428-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608715, "uuid": "0e9c3b93-fe8f-466f-9ce7-57b0473087bc", "comment": "Malware payload (Mirai)", "value": "790b9f3cfe35aef1a81834af88310fb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608715, "uuid": "a1620c6d-8db4-4010-bc5f-b0ebf69ab803", "comment": "Malware payload (Mirai)", "value": "8ea6024a1326f85c246679826dffc0396ab5935e8ca931d77f223b5b0e5302d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608715, "uuid": "50c37a43-49b8-442b-93e4-f51b923e272f", "comment": "Malware payload (Mirai)", "value": "e788576c3e3d9206243019b131269ed875b67198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608715, "uuid": "11100974-dcb7-471d-af3b-51b21c23a0d4", "comment": "Malware payload (Mirai)", "value": "168fe28f8064a49726c25c8f5d6ea7e2fc53881e349293021ac6622a901bff27c83c0b3048c64d669afa8b3d51e24faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608715, "uuid": "31cb99e6-da10-4e61-b215-0de07101ceb8", "value": "T1A5136BA3CD3A2F18D2588675F5255B7D5B23E914C64B0EAA8076C279D103EDCF4893F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608715, "uuid": "7b2a1d24-a9e8-45be-98fb-e913d03eff59", "value": "768:LJBhkJExiSAnp4PkZTpIvc5J2fO1K3GBs7/amqo0ZdczC5tDFTfcEsz0I:rhviSAfZB50iK3GBs7imN0QzC5MPz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608715, "uuid": "6ac4998d-a27e-48da-82aa-ea91f3348f32", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608715, "uuid": "98c60a28-892e-4bf1-8223-b3b1b903096a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608715, "uuid": "56fd611e-6a5e-45fb-b300-dfae5c10817e", "value": "niggah.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2532be7-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608705, "uuid": "bc8dd29e-5f01-460f-bc8d-3d00db014b91", "comment": "Malware payload (Mirai)", "value": "8c063555cdb2c46e0b93823d78d94b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608705, "uuid": "a01784ff-99eb-46ab-b0cf-0c13f5487f72", "comment": "Malware payload (Mirai)", "value": "904cf1702e86d45bc0f9d9f800721b4bd97628a2fdd43eabeb1885e783ffd612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608705, "uuid": "1b898b34-1d4b-4fb9-b43e-b0b19373f6bb", "comment": "Malware payload (Mirai)", "value": "e12816ddbd9914b89b1e8754f0ecfcedb1a93be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608705, "uuid": "35d482e7-0289-4a9a-9954-dbecf4726c2a", "comment": "Malware payload (Mirai)", "value": "4f944f9c97db03b92fdf9be36149f1850f4b6d31fcb1280651185d095dcef5a1159ebb0dcf9ce426810e935324c5ab47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608705, "uuid": "9983d6d9-97a0-4e80-beba-1c2bbd850944", "value": "T1BFB2E1F89282C784EBEFE974BDC8CAC553A1479EB350CD82A92AE701A74347557107C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608705, "uuid": "0c918795-975a-4c46-9811-20c1eacb7785", "value": "768:rPuO0E5w3JzdnqQAAGe9gGej4uVcqgw093:rPLFw3rnq2nZA4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608705, "uuid": "104c0291-cd81-435f-a60b-a15706750fef", "value": 25512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608705, "uuid": "30017f95-cc57-45da-9376-c41eb91a9825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608705, "uuid": "ef7c5936-54f3-4169-8c28-56b25005bfcd", "value": "niggah.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513014e5-ce7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568948, "uuid": "f7355b67-6932-4a50-87ed-9bac93a61333", "comment": "Malware payload (Mirai)", "value": "69c465e29f497b65fcf26814c417a5cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568948, "uuid": "ae78736f-62cd-4df2-b17e-bf2060bf65a1", "comment": "Malware payload (Mirai)", "value": "90ab5e82dfb60f52d7c114d6dab0aac60a7bb0385e0c063e01c21ebdcc8b4fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568948, "uuid": "e876142d-5217-4e47-a4fc-0b59c9a91a97", "comment": "Malware payload (Mirai)", "value": "708b1539433c8dd0acf76ff6d6d027b4c1a31b8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568948, "uuid": "63f5593d-41ff-47f3-903a-a4599d3e8252", "comment": "Malware payload (Mirai)", "value": "69f72151ca6b8fd284ec8b3e3da2d169b9f8aa6cb74fecebdfed4785467683a5593722fda48c2ff49c061528d60002e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568948, "uuid": "cc94e3fe-6592-4c3a-be45-6e5d28a13697", "value": "T162B34BD9F643D0FAE81605302176FB37AD72E9BE2228D983D3B89E367C12641D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568948, "uuid": "bf9809aa-1c12-4e58-970d-c26743fd18ca", "value": "1536:O1z5kayPMrO/5e2xKKO1lDbYYc+Wy7w5qR6U0NhbsnxA3S6as3n0:KkMrG5e2xKKkl97Aq0Uots2as30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568948, "uuid": "30bf75c4-18c1-48f3-837c-be9dd0feec34", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568948, "uuid": "f0eca3b0-733b-4780-b12b-98a620956c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568948, "uuid": "0478ea23-13e3-4759-88cb-3ed0b24db226", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e58bb21-ce74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565964, "uuid": "8388135c-e8d2-4446-b1eb-481ef055fc51", "comment": "Malware payload (Mirai)", "value": "4aedd8dca5b6258a8a0350e74dd94be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565964, "uuid": "e8ffda62-387b-4201-9689-76af1df90013", "comment": "Malware payload (Mirai)", "value": "9106eba507c40ce809c9509ce57469dc2efb0358fd249e8cd0ea735e28e968c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565964, "uuid": "3c10614c-df6b-433f-b6a9-58ed596d8192", "comment": "Malware payload (Mirai)", "value": "846c75d620a6226f490afb5b624bddfbd1985262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565964, "uuid": "7d265157-204a-4386-8c33-5f3451290770", "comment": "Malware payload (Mirai)", "value": "e140ab888f54872182f7f31d1ebfedc62a8857b6029634e1483bf6bbf226b0970f4aeee30040c718c111ecaf09521005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565964, "uuid": "4a94f6e8-1c19-407a-95bf-4841c8053daa", "value": "T19633F2849F1768F3C3F834B6C760C54BEE3E47A4F18B21424F694638646A76D5A9C193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565964, "uuid": "713d9f9c-43ec-4f03-bd79-8d1d579ac473", "value": "1536:FO26s+W5T7wktU+YbeZG5C1X8k+XdVSVhLr:8+5T7wkR5irMhLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565964, "uuid": "4f412879-711f-4377-ad35-ac9e415e81c3", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565964, "uuid": "f5f3553e-c302-49d9-b5d1-aa66a011d30c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565964, "uuid": "eb3d1ab7-127d-4a19-82b3-3fa1bc4ae8db", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b84863-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764547429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547429, "uuid": "0d92a0b4-b257-42bc-b1f4-6bea8d140356", "comment": "Malware payload", "value": "c66a9906f5bf3048d67752b0685deed7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547429, "uuid": "c845dbe9-9099-4810-b633-795d18efdeed", "comment": "Malware payload", "value": "910c12f1c38a7dd49b27f6106439841751bf2ed70825ff1eb15734d25f16931e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547429, "uuid": "5988f040-bdc8-4407-a873-fd8e57ce3b76", "comment": "Malware payload", "value": "7edf4b3cb3e80d3fa8589085f2bda457908b5095", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547429, "uuid": "344c92b0-5873-4fed-8102-46d7ae51e0db", "comment": "Malware payload", "value": "743bc81c39490a9d77b9679fcb5dc1c245445ece4e51a8d1f5afa02280440742c13ed034b86a20cab264a9695ef13c91", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547429, "uuid": "078799b0-0a72-46ad-90cc-ec6147818514", "value": "T12CB46CA3A39223FCD1A6C3748016362DF6B13F9556284696815AF7210F37A8C6F7EF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547429, "uuid": "4e112220-fd2b-481f-b494-37becbd90723", "value": "9e9f8c0322f5e18e291f003f8d9f0daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547429, "uuid": "cb016a33-b9cf-4da2-86fd-01e0fbd0ebb5", "value": "12288:r3VWOji58Fb1cR6Z3rhtUJBRbvUG+7qIFM:wO71O6Z3rhuJBBUGaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547429, "uuid": "afd8825e-536f-47ac-a4c8-976ab8e6c7dc", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547429, "uuid": "0eb66b3c-e891-4ca0-9ffd-00d55b47afdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547429, "uuid": "35ac38c0-bafa-4677-8bea-7cfcd754dcbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0da16c-cf06-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764628645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628645, "uuid": "aed35cdb-5557-4d73-86fc-4878e8135a2b", "comment": "Malware payload", "value": "e552a2e11494e7f4270134d1d219d9a2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628645, "uuid": "7e3d016e-b64c-4fb1-8ed4-f07b208074d3", "comment": "Malware payload", "value": "915a5fe39c85afdeed6283d5a7766e9bd230de5e32d66c3d4e77756dbd0d2621", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628645, "uuid": "7a18e33b-2b62-4f1c-b0c2-ed1750c676c7", "comment": "Malware payload", "value": "598cd47b8c2a4e70f2bd44904879b279b099b77e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628645, "uuid": "f50dcf87-a991-4d24-a026-af056e0cf23a", "comment": "Malware payload", "value": "0a224afbda142364a0eb1f7ac686a958abaf6e8d3acd2e10d599759fd919d7a8ec13de2c3481180d4807b834b32e616b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628645, "uuid": "f18484f1-f645-4a36-b7c9-a3d9057d37df", "value": "T140A53341DBDC2833CD6717B134FA866B293A7CB45C38460B07F5AA8A5EB27A40635377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628645, "uuid": "2aef5197-13e9-4cbc-bea1-778c9bb3b997", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628645, "uuid": "56091fcc-4dfb-433a-8bee-da71040c1104", "value": "49152:6kUBIn+fmy1pxIGHFFPaiOtFZPlzaGFeG8RFtt8RIw0yzUyQj5+2qp:ABI+fFpxIYqrZgGp8RaOw0qUeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628645, "uuid": "2cbd5439-33a1-4492-b9bb-c252bd54b470", "value": 2201992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628645, "uuid": "d90bfbb6-00e0-4d5d-b67a-25a14b8b609f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628645, "uuid": "28f71a6c-0e47-45c2-a8ab-c0823d6c38b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44bb598-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764621191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621191, "uuid": "34e7b544-a478-450a-bd54-72831af84a3e", "comment": "Malware payload (CoinMiner)", "value": "5616a3471565d34d779b5b3d0520bb70", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621191, "uuid": "e176b69b-538f-478e-9444-f3c068f808dd", "comment": "Malware payload (CoinMiner)", "value": "9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621191, "uuid": "5dad871f-811c-4b0e-8734-3d4a00e8ed9a", "comment": "Malware payload (CoinMiner)", "value": "42df726156bee4a54ea328bd72a659602ab7d03e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621191, "uuid": "7b656e79-209b-44d2-8b7b-748674a8353f", "comment": "Malware payload (CoinMiner)", "value": "d716ba15969350fde8815e25ec4692317d33224ab163a683ac53d44753a33f2a7175bba36135daa1545de3727096d380", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621191, "uuid": "1a1cdf56-d86b-47fb-ba8b-1830d5e6d7e8", "value": "T151563345F4809837F139153629F980F2B07DBC7297244BDBA35E2AA56E317D83239A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621191, "uuid": "47368889-c2dd-4c33-a123-63a0fbc7de5d", "value": "91ae93ed3ff0d6f8a4f22d2edd30a58e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621191, "uuid": "92f61a57-2021-412f-991c-7926b04bcaf2", "value": "98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:tBfTCiUs0VSLOJgyBGUA8Ch8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621191, "uuid": "541392af-470e-4d4b-bb2f-e45168c8ea66", "value": 6227159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621191, "uuid": "01bf195c-f9a8-4954-acdb-99d6ff7cd5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621191, "uuid": "c561a93b-4bd4-4e55-991a-34a62c8bd6b5", "value": "Video.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8198b396-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578049, "uuid": "4c9d7101-13f5-435f-84ce-09f506e1de39", "comment": "Malware payload", "value": "bd7ebe06b24d85a0a4dd4a16a002c530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578049, "uuid": "945d128f-b3a7-4501-9b2a-5ed0b2660882", "comment": "Malware payload", "value": "91c35a15bb6f59232e1cf27a888c240bb45b6825911ac58e39d100987d08d5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578049, "uuid": "0ac4dace-3476-473e-b907-07420b4d45b0", "comment": "Malware payload", "value": "013227d64ad85f3938825997b291942e01761967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578049, "uuid": "c67ed241-901e-4654-a453-16922ee4da1f", "comment": "Malware payload", "value": "f98dd73a14221113788dd731d799fb32de7442930c38aa6626af7000ea6cbee04c8a94f8fed50d970968e2df0ebad69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578049, "uuid": "7d88e152-d6d0-4141-a1c5-45e4c6a932b8", "value": "T1EA850112BECD6582D5250A36455E8385E220AE747A5D32277CCFF72FC8B13C2B60EB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578049, "uuid": "418a8d2b-1c24-4047-b781-a5b313129d96", "value": "f3a18f6bc71f0bf3e9f212a1871a8d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578049, "uuid": "739b6fb3-8fb4-48ed-8a2e-cdc4abcd1291", "value": "24576:VzTTTu41kEGqWtH1beh7iA+jePTZpolkvINE1xQonp8SlnrZzO6v/6EPk:VzTTV1kEGLtt1A+jqT087QulnVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578049, "uuid": "5953ba6c-6c88-4b89-bf7a-b653f68a5ce0", "value": 1813504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578049, "uuid": "7fd571a9-3c3e-43c8-a49b-1d05f82503d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578049, "uuid": "5c421221-1e9e-4d2a-ba56-877ba383a1bb", "value": "setupMP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226cb1d5-ce79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568011, "uuid": "cbca52a6-1b74-40cd-86c9-31432e71bd55", "comment": "Malware payload (Mirai)", "value": "8d929061df7b142b5f2edd3234e373fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568011, "uuid": "fbd09be6-26f1-403b-b850-1dfa88b57be3", "comment": "Malware payload (Mirai)", "value": "92e42d98d68858e5efac5191e3198b70542b520f3499d32dcffe7bc3fa6ba70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568011, "uuid": "04c32644-4ee2-47e6-97ae-4eb44e0d14bf", "comment": "Malware payload (Mirai)", "value": "281461a7990bbfd7d82302b680167e74e552904a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568011, "uuid": "c77d6296-edf4-467a-9f39-de9513ad9d32", "comment": "Malware payload (Mirai)", "value": "a8d210e2a64a0d30135c6051f8a840d70ef3d67c3324ba0233b0b984df8b638a546949a22c4e3a826a8d644d69c5f292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568011, "uuid": "71316d9d-9354-41aa-8153-04f62596d700", "value": "T14923E18694EAC264D427A1F3384BF5C8AC79BA57451B5A3F2DCFB31B0C6DA606528620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568011, "uuid": "29609cd4-b9c0-4eca-9df2-8fd1e19b6f1e", "value": "768:MtB548w628WWpbLcWgmTigHkxre0NYLLbN4qTEuxzMgfu74k62utjGXlx05F:kBw62YcWWxre0NYfbN4qzXg6p5GVAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568011, "uuid": "3b76bdad-a2aa-46a8-ac6d-c0199e12ee1c", "value": 47932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568011, "uuid": "34eb9d97-a569-415a-8824-4e061c661dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568011, "uuid": "217d2e74-8b9d-478f-b508-b49a65fffb6f", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab6777a-cf01-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764626597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626597, "uuid": "3277d5cd-3d70-45ae-867c-f18e089d065b", "comment": "Malware payload", "value": "e650770bc95a5e9f7785b91b5a3c7e38", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626597, "uuid": "b27a28b9-182d-44ef-88de-1e93716a000f", "comment": "Malware payload", "value": "94413e736325e73dddc9cb09cea2335f080395e896ec22d9719ad03d3bc2fcda", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626597, "uuid": "b4fbf905-c798-46a5-bf41-a564e1578330", "comment": "Malware payload", "value": "4794e90f00a9fea1b2000a1c9a99271ccb7eeff0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764626597, "uuid": "8cf99190-801b-47ce-941a-dae037b62d56", "comment": "Malware payload", "value": "dc77fe4941a148829ecc2097f09eeee1ddf3de1f12cadec647e44a47ab187c66d088eef69a8dfaf1724cb4e2f313cb1a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626597, "uuid": "3621f5ae-7582-488a-a87a-9d075a2b5ad7", "value": "T14E73748C09CB81F8B62374A486DFCC06F7E58613562CD6D5BA5DA4E23F51428B3F96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626597, "uuid": "ae7d9821-a08b-42ee-a5c8-6619046474cf", "value": "768:A14uqNaWXW+4AfiOMrM7Qp1mkWwJUxswqgUdG2AkSBFmB/y0/tNMI/NWZC+nufRt:q4ukZ0wDUw2vSinOprf5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764626597, "uuid": "167ccdf3-b7a1-40af-9fd9-6872b101a94f", "value": 76435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764626597, "uuid": "7a0d3c96-d554-4f97-9b84-b2201680344a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764626597, "uuid": "2d9b8456-d6bf-4183-8ea8-aaf33a43660d", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d08c84-ce86-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764573956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573956, "uuid": "506f6f25-ec4c-4dac-8cf7-6f16f79f1921", "comment": "Malware payload", "value": "2d62d4823962a4344d00d7b1d2aacdf5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573956, "uuid": "738cd106-8822-450f-93ae-697a7b439d1f", "comment": "Malware payload", "value": "94a6aa311fe2e5cd0d6c1ae481293cc95839f37e0972fe794105d127fcc65d2d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573956, "uuid": "f7d62c23-fa83-4f25-b6ff-54324b9f8b40", "comment": "Malware payload", "value": "3789cb225784bd66b0e785278a5c3231e1deb435", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573956, "uuid": "5ac0cfd3-cbed-4e39-9bb3-526235edf20d", "comment": "Malware payload", "value": "2e250b39f389b91f1951dc7c571c353467c5b641cf5ebb1eb758fd0b41c1c04748f7bbdb51a482dfd100c32de586c461", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573956, "uuid": "28982458-e8cf-4be7-bf2e-c90f0dc45842", "value": "T13A4237D9064BC2FC3EB18E3FA8850677C4D6D758EEC4C4767AFB2441866E722510DAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573956, "uuid": "7780d13d-3699-43f8-bc5c-4cb7c2e9d3d3", "value": "192:A+ch6VcgEkRkj9k0k2kkkXVgkdwfRKAwBqQp/QOCwEiexZg:Fc78VaZw/p/QOCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764573956, "uuid": "1c7a5d7a-aa8b-42f9-bd16-3694963bdca2", "value": 12003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764573956, "uuid": "f6397d06-d060-41f5-b162-50c20b82a159", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573956, "uuid": "a2293381-3c9a-4f95-893b-5326ce7beabb", "value": "luiki.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd71d002-ceb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764592860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592860, "uuid": "fec4bb60-f539-49c5-b279-cfcaf9586006", "comment": "Malware payload (Mirai)", "value": "1f750e3f13e28490866e49292a89d6b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592860, "uuid": "0a93aa40-3334-4b1e-9555-4b32e9a2514d", "comment": "Malware payload (Mirai)", "value": "95373b7f9f288f391e3a6a79ba710f0735eb8f82b62680e1130095bb6f3c54a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592860, "uuid": "1338dca5-4070-4275-b88a-4b73304f2dfd", "comment": "Malware payload (Mirai)", "value": "02547047cac2a5b8ec438037c55e2a36a81219e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592860, "uuid": "e6004f73-abcd-4c86-a454-880c2864ea7d", "comment": "Malware payload (Mirai)", "value": "9155c6ffbcc8ee983b82eaf3abc62e69aa3fa818a670e76fdfa5f74dff21e26581721643c56baeb9828ff64c8b1e1fcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592860, "uuid": "826a0e80-153c-4dbf-8165-70b9ca2ba5cc", "value": "T104558D45FF848F02C6D0123BFAAF439933339B5693C2F7065918B6347EE76694E2A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592860, "uuid": "6541d68c-f424-4580-aafd-374c651228d2", "value": "24576:FAOFZcP67WkGEycI3M+tIFRnC+sUfEd7v6thYEkh:Nm53IFRC+Vfav6v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764592860, "uuid": "69b441cd-9746-45ce-83e1-107b8ebe25b0", "value": 1300864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764592860, "uuid": "cdb40df5-ab73-4864-ba0a-902eca9e83b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592860, "uuid": "2607faa3-b86f-4ce3-91fd-e7029f36d8fa", "value": "sync.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4247753e-cea0-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764584815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584815, "uuid": "bfe36f41-26df-44a1-a432-8c9ee95f4e54", "comment": "Malware payload (a310Logger)", "value": "3810a39f77d155d11be35a8d97fdf939", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584815, "uuid": "3a0b6fed-bdc0-46b4-a899-d7cd99d155b7", "comment": "Malware payload (a310Logger)", "value": "95a4ba9811055bf67dfc40984d78bcac4fc26f8c20a51486aca4dba4de31ca3e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584815, "uuid": "a64c170d-23de-4f43-93b0-337c218178b5", "comment": "Malware payload (a310Logger)", "value": "eed878e9e51919d58cfe8b27dcc30e20040cdb4f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584815, "uuid": "2e60d7be-d190-484e-9dcb-355f634c396e", "comment": "Malware payload (a310Logger)", "value": "51f75ae6d672a485144340c6e7875e02f99f64c6656784e889bdf2365f39aa57a5b8caeb298abb4fb602ae0bbc6a1f1e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584815, "uuid": "6f5dc986-dd52-4d03-8d73-68e135873f9e", "value": "T18455BF0273C1D062FFAB92734F5AF6115ABC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584815, "uuid": "a6f49ecb-3879-4106-96c3-0bc32fa65752", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584815, "uuid": "928509ce-4aba-48eb-99fd-ea77e2b9fb72", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaEmh4hMTGYiIp3c:KPVt/LZeJbInQRaEm4MTGYi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584815, "uuid": "4a33b225-c9f5-4510-852e-9cc462908b83", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584815, "uuid": "5441bf35-e59d-494d-a19a-122bc2cb931e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584815, "uuid": "950841cb-8a14-4f41-8f96-614c82d64d0e", "value": "FQ- GILGAMESH ORDERS Submission No. GOI-2501357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b0e885-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764601950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601950, "uuid": "4bca0cda-ba05-48df-a71b-47ac8a014a36", "comment": "Malware payload", "value": "e2f5d21671d2a96f045b155f3bf74d28", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601950, "uuid": "0611d65d-a163-44b3-ac41-edf702f1a181", "comment": "Malware payload", "value": "95b06d608210a4ce1de827c8c363e0b4ae3ac897e70f208fa89921f0c6444504", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601950, "uuid": "8ca9c9e7-2ad4-4232-99f4-7b29c4a6a5e6", "comment": "Malware payload", "value": "b488f6cf3a8b0443d20ee2bae9152e3b8f4c9d17", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601950, "uuid": "9eea4959-bb4e-4a5c-ab9e-e6ab8b1b7b3a", "comment": "Malware payload", "value": "be74793b9f8792434e8ef923673455a386530f4c6f46a84eb19a2cc46a65e06d2436ac2d7b434f666d054325bcbaf321", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601950, "uuid": "395b1299-7efb-4562-b9b4-d0b38a50b58b", "value": "T111F49EBA7A9A8920D2C90F37D8C5810557E2D682D683EF4F30443BD29F477FB9D4A246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601950, "uuid": "43d05a8d-5036-4b87-8e40-130e80706a3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601950, "uuid": "0725a605-fc54-48cc-ba7c-444c22feff71", "value": "12288:bT3HlhieCXs4Uf03hQnqgIP7r4WTt28MSnAvH8MSnAvH8MSnAvH8MSnAvH8MSnAt:nzCXs4Uf0xQnOPtV6U6U6U6U6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601950, "uuid": "007f1994-4963-4d9e-964f-e3fbd0fc35b4", "value": 782504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601950, "uuid": "e17a9b13-bdb8-4c83-9bc4-5fa32222a7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601950, "uuid": "f63cb231-5fec-4285-8ed6-a0223b4f8266", "value": "3058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec72fe83-ceb0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764591972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591972, "uuid": "171422a2-cc8a-4e58-87e2-3c73b7ef8019", "comment": "Malware payload (Mirai)", "value": "aacf16df70b35378da29450ee527c7e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591972, "uuid": "46418a6f-c49c-4ab3-9a19-69f41b5db52e", "comment": "Malware payload (Mirai)", "value": "9637633bd1a0b2f9f4caabdf6bec6813c226e8e59a40dd135a3616c7fcce6c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591972, "uuid": "954e929e-7b89-4b04-a9ae-c72b85e74891", "comment": "Malware payload (Mirai)", "value": "984748befc5985e9386568544a702da59d6d6ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591972, "uuid": "337d4eb4-a845-4d43-9557-1728f216e72e", "comment": "Malware payload (Mirai)", "value": "6108451d98ae33451e605ae616fcac263eb6eb53e68ccbbcdee542b847df375b3b6b5f0df35f95242ca6f0bdff769f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591972, "uuid": "6762956b-03dd-4b98-a19e-cc0be5a0df70", "value": "T1A013E1A3D1C14F8DC85D80781DFF3E869E24E6AD9EB806F01AC065314956B763BAC693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591972, "uuid": "d8ce45f5-6b12-4f59-9f65-a42076a56e31", "value": "768:Tpf/8KshvtflEvvMYx/jXZTTRhSpwyI+DHJ7l9kn9AZCPgXmvlTd08n75DOnbcuh:9/yFfKMs/jNTRhS1LHJTSzg2F75Knouh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764591972, "uuid": "d3460f1b-2e63-4b75-8444-19c7fea1f04d", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764591972, "uuid": "0e1a20c2-3fb1-4786-a973-7935ee526283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591972, "uuid": "99bb104b-3b68-4d85-8871-33fba27046e7", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ddbc17-ce78-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764567611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567611, "uuid": "f8fda466-a730-4770-9a90-e8aff3900f8e", "comment": "Malware payload (Loki)", "value": "0302eec059217d6e4d89ea738174e372", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567611, "uuid": "68e243ab-a4ba-4f2b-9c62-351f299c7983", "comment": "Malware payload (Loki)", "value": "96502cd36566576fd7ca157915684fd5c826364b31eb51bb57dda50f51819374", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567611, "uuid": "f6280bfa-e935-4d3d-8594-c3074157e528", "comment": "Malware payload (Loki)", "value": "7229076d79c8c1a6794c86056e0d661e4611ed49", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567611, "uuid": "3b01c7f3-9318-473d-81b3-54ffdc2a81e6", "comment": "Malware payload (Loki)", "value": "4cb0ec594a929a547f7761f62d64acbaf3303c3badab3e71a5c4ddf181cceb562cfae945851c8a589f7b085cdc3db99e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567611, "uuid": "0bb7db5a-96ce-48b7-b6b2-c46ff0d5b020", "value": "T18EF3C07835E5FC1AFCA0C0301FA6DABEE75DAC14B9C2412712063F7D293A6E9871A745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567611, "uuid": "e79e4f09-cf75-4e57-ba40-10841f2fd770", "value": "3072:eH/pTzyqtdQ2YJlAZiV8TtnFi76N7X872Rx8DI1uQ/UwQ4g9P:g/pyqvQ3JleikBFE6VXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567611, "uuid": "f0563113-4980-48ae-96cf-9fea82dba9b6", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567611, "uuid": "0b689916-f643-46bb-8dce-3a26cce7923f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567611, "uuid": "7544f11f-d788-4dbf-84ea-cdc942b0adb8", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e908254b-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608717, "uuid": "638e51e3-9526-41d6-8599-af484d1d1811", "comment": "Malware payload (Mirai)", "value": "5671e4f5aea1ea09906bbf45e8942a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608717, "uuid": "f6de5437-b0b6-4a73-8051-7de44edf5d94", "comment": "Malware payload (Mirai)", "value": "9691eb602056da07d6d983e3fd485610dda3b3f6a370dbfda2bd7af75a529529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608717, "uuid": "85c726da-2f2f-4c7d-b59e-189d728899be", "comment": "Malware payload (Mirai)", "value": "243d180748286efa9371ec020fd4fdb3347e66cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608717, "uuid": "c43d7df6-5a5a-4329-845c-769a6044cc0e", "comment": "Malware payload (Mirai)", "value": "2538210b01e98aa14f7f8f116025573d2b30010c6026fc278fa16f4b9f4298743dc7d370de3594f264c242da10b60cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608717, "uuid": "3f0e8f30-9f60-4e44-a350-28a82df88a78", "value": "T16D432A31BA71181BC8C5987A62F74365F2F5478A24BCCA1B3D720E8DBF64640735B6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608717, "uuid": "f55305f6-b946-4473-bf3e-2bae5526e7e7", "value": "768:r06kpWPXYgIkss7FzcAk3IfTO+lgG5V+lld01tLoIz3:r06CqOfs7FzKslh51tLoC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608717, "uuid": "3cc898d3-216d-49dc-88a6-6029591cba61", "value": 58752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608717, "uuid": "741d82ca-5df7-467b-8bbb-014faf75eef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608717, "uuid": "d342d287-44cd-4c03-90b3-09c5b2755d41", "value": "niggah.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd62556c-ced6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764608241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608241, "uuid": "4f826420-1a17-4a81-95a0-e648618467fe", "comment": "Malware payload", "value": "47ddfef25c6ce47f2bed63c002e1ab45", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608241, "uuid": "2483c524-8b20-44f6-a63b-3c2887a8af4e", "comment": "Malware payload", "value": "97ffbc0a24d6a5e1fc47e4edecf5a64b387b896f21d1ee423380b07490a94c72", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608241, "uuid": "2dd43e5a-4ead-4fc3-ba8a-6a0a70b379bc", "comment": "Malware payload", "value": "7284e90f2e680b9640221bc52ace57205638b4a3", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608241, "uuid": "46771a39-453f-45d1-b616-b5d5352d8b25", "comment": "Malware payload", "value": "115f9a6ddfbb4596670b534f3ecaa2d3b444020e0d0a41e47d3533f1e65e2fc1ee7beca16ead63507116df422f768a59", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608241, "uuid": "4002393a-0afe-4f0d-a89f-05b0dd884558", "value": "T12D45335CD05002B1A4611A214CDAC4B4ED87F899CA8DE09ECBF92C0F699F6E77E6E41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608241, "uuid": "01a1639f-cbd8-4897-81a5-c3203a716ecb", "value": "24576:lU9cryh96Zf1v3FD8jc12gxNMVj3cZ6h3XKZMYt9PphTi7ner4JPbu+:lUqA9w1/TMVD8Kps9vOjer4JD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608241, "uuid": "eea97fe7-fda1-4d5e-88c9-ade9ac7c59ad", "value": 1193657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608241, "uuid": "85dcd549-ec28-4ec1-b8e7-29a3ed176502", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608241, "uuid": "dc72aeb6-3f69-43f8-bd0c-f2ee7c8bbb7f", "value": "comprobante-swift.0078-887.001_pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe32f3c0-ce94-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764579976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579976, "uuid": "1a24d6c7-94a8-4060-a3d3-e1decdf2adaf", "comment": "Malware payload (AsyncRAT)", "value": "9bf88267166d2b6244a4bdcc9d02113f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579976, "uuid": "4ca26800-9bdc-4793-850b-6c4c67f91a3e", "comment": "Malware payload (AsyncRAT)", "value": "9843874eb6217a79ba5a51a6a886745169b1a1ad43f7ae12de6e610324e88ab7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579976, "uuid": "272b206f-03a0-419c-abda-880de7067d98", "comment": "Malware payload (AsyncRAT)", "value": "bc5cba6bbb5c724c0d49c6985948b6907d514aa7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764579976, "uuid": "c9873682-23f0-4070-9f47-000d995abc5c", "comment": "Malware payload (AsyncRAT)", "value": "13ab425b04725dc22641d4ec31f0d5b41df57cc738e8a7b83aa35d39ac878ccb5f1c6c5b2c62af59694e291ccfc6b9bd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579976, "uuid": "478fb8b9-d488-480d-96df-41c3fe7c602d", "value": "T1CA635267A569F80042E6C563C369F617DD589E3FF50078371461FA988BF1A8C2E839CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579976, "uuid": "4b3f8ae7-5ab2-4753-a32d-a28ed3e54d9a", "value": "48:cYeFz+VNZIo5AsZ/un6QPwgb6loELjw4KwQyFD2bsSPE3tj9bN6Fe+8Z92GWgeCx:5eMNAwFSsLw8PVrjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764579976, "uuid": "bd48b8b0-ae1e-4806-95ff-72d0a2b953cb", "value": 72436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764579976, "uuid": "935d961e-b2bb-4838-b0dc-c2908b0a4c7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764579976, "uuid": "244e0ee5-a748-467b-aac3-f0ae143f246e", "value": "Libya_Jordan_File.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4987d548-ce4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764549178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549178, "uuid": "23a9d5fb-9c86-4bbf-b12c-dd6f237350bb", "comment": "Malware payload (Mirai)", "value": "47b4a3f0a78d475c4dfc2fd349d72f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549178, "uuid": "118df77f-b62e-4fab-b8c7-b63ee2f4f62b", "comment": "Malware payload (Mirai)", "value": "98d6535254d30aacf14379005a74f4298c1dea7bd2bd90a97c0aa2ecd667cae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549178, "uuid": "97684c09-6f0a-40bc-996a-11c6271b67fd", "comment": "Malware payload (Mirai)", "value": "166d64f117d568e66e79d1289a343500de5ebf9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549178, "uuid": "2979d639-5bfa-4e83-8b14-5d592dde737a", "comment": "Malware payload (Mirai)", "value": "e7dc8966d0454c6df9d32a53a0b7d90d8a900790277234ff1b5d1c9c203dc0fb109fd1429adea59e8cd8b4fad28c7edb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549178, "uuid": "4da249f8-e25c-4c86-a214-98597614c8e9", "value": "T1CA630264DCEF5B68F212A1BD53E3601E720A17BA0750236718C0C7F61E7B9B26574AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549178, "uuid": "ee6d6eaf-7f36-4186-bcb4-1ce75dedace7", "value": "1536:faxQtS/wkTWAqeQkHxDhFJBul3/Gtx8tVm7XIBtPfjXRo3ZG:fGQtSRUeQkHxDJB+Gtx8tVm74BtPfjRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764549178, "uuid": "8d6c963d-5440-4ee6-89af-6fb275069237", "value": 68668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764549178, "uuid": "4e757507-6146-4f41-97a6-c6bb9fadc4f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549178, "uuid": "2df3c057-dddc-4e79-b9c3-bf2d343f67da", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edf0007-ceec-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764617531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764617531, "uuid": "1d487a5d-2407-41b5-adfa-a237036a01a2", "comment": "Malware payload (RedLineStealer)", "value": "aa245b6006ef6e24763ed2fbb598834a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764617531, "uuid": "621b141f-0b88-437e-95ef-340b268ca07f", "comment": "Malware payload (RedLineStealer)", "value": "9929f1d675a2190594aef5ec37ab22af416879539d8ffb5c80194d2d3e8edcc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764617531, "uuid": "ad3043c2-e7dc-46a1-ab05-64a8bae2276a", "comment": "Malware payload (RedLineStealer)", "value": "5408ca6b0659ec7faa7cf506f1f5ed57a748e373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764617531, "uuid": "2d985622-030a-4c32-8de4-9baa42ee125f", "comment": "Malware payload (RedLineStealer)", "value": "6390d10a4fb6bf0efd1a9b24970f9923607638207e87c3d50be14f4ccef34791535cf0808f8cd5a46e5a18cad6a3551b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764617531, "uuid": "b4c74561-1c6f-45f1-ab7e-8a9de9e0706e", "value": "T132A5F1027381C062FFAB95334B96F6155ABD7D260123A62F13981DB9FE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764617531, "uuid": "57ab2616-8f0d-40d2-84a2-614f96f0124f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764617531, "uuid": "d09cba52-4fec-455c-a2e6-d62a896f830a", "value": "49152:oPVtuLZeJbInQRaht1d9epupiXc9jcDmg27RnWGj:2sYbInQA7opupiXc9jcD527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764617531, "uuid": "e27309c7-aa2f-429d-a503-050d7e13e433", "value": 2265600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764617531, "uuid": "70ce8aee-1faa-496c-8a24-3212ff16d6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764617531, "uuid": "c34198c0-f801-4f25-9b90-108c8dff9533", "value": "Request for Best Discounted Price NPO 2501117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5b4d14-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621879, "uuid": "9ab4cdf1-fbd7-4314-b521-2fe2f261fba3", "comment": "Malware payload", "value": "1254fd73c4fa35cb0907a003a53bb7ee", "object_relation": "md5", "Tag": [ { "name": "ms-team-ping7-com", "colour": "#931072", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621879, "uuid": "0718ffe8-4451-4c7f-abb1-f4e683b6cf2a", "comment": "Malware payload", "value": "99340600db5fd3355a3d7ba9e243b65630d928e70afbfb401bce4e16d194e22a", "object_relation": "sha256", "Tag": [ { "name": "ms-team-ping7-com", "colour": "#931072", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621879, "uuid": "b2d432fc-0322-4140-a055-554d9a891cd9", "comment": "Malware payload", "value": "284deb17388b41ebdce35e16309b836f747dd72f", "object_relation": "sha1", "Tag": [ { "name": "ms-team-ping7-com", "colour": "#931072", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621879, "uuid": "e17c7641-e436-48c8-bf39-813c6bb5067c", "comment": "Malware payload", "value": "ebd5aec0940cfd1b4324fa73fe8886f621359a91bce43a164a752e241028522cbb8e72600febcc2598f57494fa404697", "object_relation": "sha3-384", "Tag": [ { "name": "ms-team-ping7-com", "colour": "#931072", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621879, "uuid": "f230277a-cf45-4e2f-a5b4-cc3b9aa5ff2b", "value": "T196D38217EE43B5220533C65D9C6AE406E71843A7710922277CECD6982F35825D3FAFAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621879, "uuid": "05d8b3f6-b844-446a-8a78-5948656f3653", "value": "3072:Ysbp4tHyAOJ48WwycCMnT6d/E8iEcLBb86xMhqSsGjQcOjQM4s:/d4tHy148BycC6T8/3izbcqpGjtOUM4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621879, "uuid": "8a5d0fcb-1224-49d2-88c8-2160cae0f47f", "value": 131809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621879, "uuid": "98681154-ef92-40b3-87e5-a13014a7fdab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621879, "uuid": "0bc28dce-ecf6-464d-b021-b0ba015f2fff", "value": "inspect.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3ce53c-ce99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764581989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581989, "uuid": "fa58a485-cbd7-4574-86b1-72e69a392d27", "comment": "Malware payload (Mirai)", "value": "0e6a4a24abc7e1cd8d6c1477d8f0c91d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581989, "uuid": "234529f8-5d73-4578-84e7-b0f21b72985b", "comment": "Malware payload (Mirai)", "value": "996a21a3851d921be9091d355b2c26a89d1235bf84a506854c38032676d7a417", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581989, "uuid": "0c4adfeb-0e79-47f2-a11b-aad5cf05987e", "comment": "Malware payload (Mirai)", "value": "beb0fde7e8c47da27cea591b5039c98f6c623d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581989, "uuid": "136b7776-e713-4e07-81c4-a941012ef651", "comment": "Malware payload (Mirai)", "value": "f401197a75c162197517543e711012da556ba02dc78a80447d7f56fbe5938698b44662dbe8144699438dd4a339d871d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581989, "uuid": "e22a2351-f797-4a17-9e3e-311961d0a825", "value": "T1DCD3BE31F0296CF0EC110AB434B685781742AFB406E91143EEBEE5AE54B7E58BDED760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581989, "uuid": "05ddcde0-cf17-43ab-8591-d5be965d442d", "value": "3072:SKY7tbknDflICoLHN/Kq3iGJMFPbBopzMZ8:SKYhbknTlyzN/bTy5bBotG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764581989, "uuid": "2194eaed-e3ad-444a-a9f8-912da3534f24", "value": 131668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764581989, "uuid": "e1355365-171c-4865-8e30-be78301ec997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581989, "uuid": "bd220651-7ea4-4fbe-aed3-3521c262fb69", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952f6ee3-ce82-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764572069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572069, "uuid": "a115a0a8-ee29-4629-90f0-b4f31bfdf942", "comment": "Malware payload (Formbook)", "value": "fb1dd4c76de2f93ba86feeb3b96ecc96", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572069, "uuid": "64eec411-384e-4b34-b3e5-46285fd47813", "comment": "Malware payload (Formbook)", "value": "996fb9828d907922b485a7f913c841686663c8a8f0f4a3efdb2dd63b0b6e393b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572069, "uuid": "12f91864-7267-4cb7-88be-de1764c6e9dd", "comment": "Malware payload (Formbook)", "value": "252561cbf59ea2dfad5e036a3c7fc19d1cbbf9e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572069, "uuid": "68dca9c6-d309-4582-88d2-834a72c37e27", "comment": "Malware payload (Formbook)", "value": "8623f57ff743434020ef538bef7a0820b04a8cf8fefb147e8bda1953237d74b3bf4329184227b1b54b9c9b9137c70d7c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572069, "uuid": "c3d19a41-d095-449c-832d-21704aee86da", "value": "T12644331862E0785423A31BB7B3ABF9D5ECBB469D3584049BC911FC50B1B4B27E9E1E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572069, "uuid": "d3fcf840-b7ae-44a3-9b4c-b85521826111", "value": "3072:yHnxlBhQbCIUC/51Jfbnx9Q3VFU0/jonhC0ny6jcEdN:SnxPKWITxsbsC0ny6jcMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572069, "uuid": "548c05c2-ba80-49c5-806b-08f98af0ea80", "value": 260621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572069, "uuid": "1ef62a80-c419-4351-b08a-98482f01aa45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572069, "uuid": "69d381fe-3b5b-4aa3-9adb-35dd47189643", "value": "Factura.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb2519e-ce77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764567201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567201, "uuid": "e038beb9-d6e2-4e62-9e7b-5aacf6479d1e", "comment": "Malware payload (Mirai)", "value": "5e2a619ee7ec85c9826c77e608b88a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567201, "uuid": "9e4f43bc-86d8-4787-9404-824cafa7e665", "comment": "Malware payload (Mirai)", "value": "997160813c19443418b4ac68ba4cdbbcc8194c8fa6fc66733f5af399eaad8065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567201, "uuid": "038be40a-72ff-4555-ad83-9dfa1c14fa1c", "comment": "Malware payload (Mirai)", "value": "56d77410db71b736752e79b7e31cfcb09ddb3149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567201, "uuid": "6a8e9e98-d8dd-488e-9525-16ad81472b11", "comment": "Malware payload (Mirai)", "value": "fc4475f7246e1fc6ae67cf787a29259d378856c98c7eb7e597d5b277952f4eb9cad26c8b560b1d8ee1982afc396f8e67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567201, "uuid": "d1dca2a1-ea21-4ea2-9d31-1045604e0f72", "value": "T17DB35BD9F643D0FAE81605302176FB376D72E9BE2228D983D3B89E727C12A41D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567201, "uuid": "e3387345-dc13-4e3b-8763-aebe81959126", "value": "1536:O1z5kayPMrO/5e2xKKO1lObIO2FDy7w5qR6U0NhbsnxA3S6BS4nY:KkMrG5e2xKKkIr7Aq0Uots2BSCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567201, "uuid": "7ef326ce-1f3e-4834-b09d-52da6dcb1ade", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567201, "uuid": "8362dab5-753f-4511-a65f-0c808a99f614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567201, "uuid": "b355aa42-1e9b-40fe-843a-fb86baaaf984", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e5e2f3-ceb6-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764594298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594298, "uuid": "1524d59f-2ced-4078-8a17-7ab1c7f6ec36", "comment": "Malware payload (NetSupport)", "value": "d2db9cba1bcee6141d94a57aca28dc8d", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594298, "uuid": "f752843a-be83-48fc-a643-952a8f5447e7", "comment": "Malware payload (NetSupport)", "value": "99d0e466e0268cd6528e536a276c98bff8f4169ff75011555c718cc82c7cab82", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594298, "uuid": "7a67810f-4c41-402d-8073-a381c28cfb52", "comment": "Malware payload (NetSupport)", "value": "fe871aa80552e6ad0ef28d498f832d7e5cac8bdb", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764594298, "uuid": "ecafb151-6660-44b1-a46d-9d37826f972e", "comment": "Malware payload (NetSupport)", "value": "e6a4ffed185421cd597a64697b37677b3d05194090e719e5f6d84e913c0d106e98860ce432b55eeff0a110f933bbe51d", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594298, "uuid": "d8473fff-a4b0-4d50-8a55-477b9541ed62", "value": "T1AA867EF244D71CBBDE5C6A0A41183E90ED6909D76F084953BB283FB9B1E98949D3C4BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594298, "uuid": "40f7fb8f-50e7-4bea-bb84-250dd9732fd0", "value": "49152:XzXmX3aXU+yY/F4+9v5Py/ncOtAT9qN5izc829/EvUw2Z2ORDHHIS8H4l/TwHqmA:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764594298, "uuid": "c5185d03-195d-432b-bb09-29cd14748647", "value": 8423713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764594298, "uuid": "bc633738-9440-4df5-bc56-e5c2674f0531", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764594298, "uuid": "7f230f78-1936-434e-a111-7ded89260ad5", "value": "jsit.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f2f81-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621290, "uuid": "120384da-226a-4327-9570-2cdacaf969cb", "comment": "Malware payload", "value": "c7b569440730873f3d51c139d112abf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621290, "uuid": "9830a3fe-27c9-4507-815f-3de736fb6393", "comment": "Malware payload", "value": "99e20add7d779da22b809938e0cbf50f7ddeb1cb308c8480efe0e0dc310d594b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621290, "uuid": "5ab6dfe8-e54e-4fa6-8b42-f8bc34d960c8", "comment": "Malware payload", "value": "62a156bb035d9937822070c5717b5ba5b79b7e50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621290, "uuid": "08cd301b-5970-45c5-a48e-06b1ecfde27b", "comment": "Malware payload", "value": "fa0536f763a5bf2957cfed242721251a5ecc100d4a8eee18782d427fb6137a372c9ac47f79ec4cd751776b00935f8f7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621290, "uuid": "5ce68184-cea4-4e20-a8ea-330a25fad0d2", "value": "T1FE75334A096AD8398DF7A330CAECC57C97E6D9765E85AE9308D8C4304575B2E783338D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621290, "uuid": "5666d235-95c6-4b56-b547-05031c397938", "value": "24576:JPsXEQteyjlOZDuPS9ak3jX3SpS9vzLCjv1xkcECX9oU7JwJqWxfF1lX737pAjwf:a0l4UuPS9aampv1mBUCsil3pAjmGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621290, "uuid": "0668dc32-92d5-4a92-9d59-5d59019dcc08", "value": 1695448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621290, "uuid": "61ebb1c6-f64d-4ec9-b2a3-57bd7af6208c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621290, "uuid": "ae58c4b4-0bd2-4eee-96da-4c793a1fb3e1", "value": "mumei.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5446f592-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764598159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598159, "uuid": "97d67704-1d0b-4738-bd5d-362974c062cf", "comment": "Malware payload (a310Logger)", "value": "ba5490a7f6822bda196527ebf208865c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598159, "uuid": "c56d3f75-df34-42cc-8a7e-439384be005a", "comment": "Malware payload (a310Logger)", "value": "9a185fa9a33723bbd7bc316e9fe0d0a7c3b843d320aa298f7183b15c707114a9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598159, "uuid": "8da74feb-5493-4358-8e74-dd5aa1a69ad4", "comment": "Malware payload (a310Logger)", "value": "429d4a7fbc135376945bb33433a89f8313cbf75d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598159, "uuid": "b1aeb5e8-7b16-4dea-b584-6d15ccd72cd9", "comment": "Malware payload (a310Logger)", "value": "7a46ff89fb02f5a9ad9e95f93117e4298114ada59fd56a69665761e94e9968f61a930cfac4e824746e4635b15b8a997f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598159, "uuid": "26e1eca2-c575-4c26-89ef-aac05e3bd39f", "value": "T1E9759D023381CF21FE5F9132CA56E2F1467B6E11CD13A7DF13983D79B9B01A1562A6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598159, "uuid": "0c45f42a-7cc8-42fc-ad0b-48a72e7b4622", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598159, "uuid": "0a40947f-7817-43df-a9e6-919794a42077", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1MAXDzBTO1S+jKDl+Pgn87DLMVqFIYPMSe:0PVt/LZeJbInGizNOtYl+Pgn87DLM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598159, "uuid": "80c3a4fb-8afb-4975-8282-af146eabb6b2", "value": 1676800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598159, "uuid": "b0fd4a7b-9a8e-472f-a349-07232bbc4b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598159, "uuid": "6a322ee2-b826-4734-8e38-e59fa9aa6a36", "value": "OOLU2566777430000739829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9a6f08-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764621287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621287, "uuid": "b5adbbe3-4257-4eba-a87f-05c4d3373193", "comment": "Malware payload (Mirai)", "value": "91b84a6a41df09c1e21dcfa96e578d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621287, "uuid": "0f9def20-df21-40b7-98a0-bb46e69c1240", "comment": "Malware payload (Mirai)", "value": "9b500ff92452936ce8b7c4037332748aeaf5ff8af167ec7b0d9bde9f93983c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621287, "uuid": "324f0a00-64e0-460a-9c55-4f9e4e9efcc5", "comment": "Malware payload (Mirai)", "value": "ca4885110b98c9922932ee7cee12b59be03d3c33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621287, "uuid": "7518b8e5-74b8-4476-9d8b-ed9ed37265e5", "comment": "Malware payload (Mirai)", "value": "b77c817bc17db248f366679a86e0635e70453db9971c2bbb46589c8f86a2855a62036c7401dfea39c9e5e02ea9e09390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621287, "uuid": "d229ce0f-8417-4d33-98ed-f74ab0e6b4b8", "value": "T1C1465B0AFD14CF61C6A003BA49B912852371AD036FC74713A338F77CBDB6698ED16699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621287, "uuid": "df13cda1-fd63-4fa4-ae7c-2598d963ffb5", "value": "49152:5q6a3WH+Rgw7HgAZSfkk6Xn7UJswg8p15FWoi0rNOEg5EM:Ep3WHIHgAZSlWoiY+EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621287, "uuid": "98550a12-19bb-4c5a-8b1f-4b21aa4b8e1b", "value": 5832852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621287, "uuid": "758f4381-14f0-456d-b3b0-ef7176be4eb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621287, "uuid": "c6983f38-62b9-444f-a2f2-6a3b9a0119f1", "value": "mori.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192d447d-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621253, "uuid": "76306762-4c2d-4d5a-99c8-9cc1326ed480", "comment": "Malware payload", "value": "ac52abfe0ebe116c353443f656915e3a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621253, "uuid": "dce4b921-1d62-4ff2-8161-3e68824c4ccb", "comment": "Malware payload", "value": "9c40e8936aa672bb2e675f76858c4dc1ca0aa5bd1d400b885912113766cde97a", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621253, "uuid": "02f824db-8607-4aa2-8157-869f92737aed", "comment": "Malware payload", "value": "47a314c17656ee7cdbcd30dd0a4080f7b85eaa4a", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621253, "uuid": "3672fb36-9593-4b2c-87d1-01adac85c417", "comment": "Malware payload", "value": "ae1e4fd8a0e81d4e4790fc3ae1f405a7ff55a1a1fe9a1d7387077a99718938d69c3d6915ab7a25a360ea282274815e11", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621253, "uuid": "6e9855a9-d022-45e5-919e-bba977cd61f8", "value": "T1A5D6334852D012FAFAB3803DADF015B5E6613DA62375CACF87A456A1AE473D48C3C727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621253, "uuid": "67b4a95c-23b2-4e3f-9818-1a775bd85178", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621253, "uuid": "75bd9458-7a86-4394-9ebf-f032928c96b7", "value": "393216:o2t/YHjmOZJdUVEOI2+gqYULlXMCHWUjrcuI3/PjuUwh:o0sNd4nPqzLlXMb8IH/rAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621253, "uuid": "5f3991dd-78c1-47b6-821a-813ad7e6778d", "value": 12624287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621253, "uuid": "dda80ee7-b6fc-4823-af60-8152aa553863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621253, "uuid": "d0647aa3-afc6-441c-adcf-91e14c48fc79", "value": "ef\ud835\udc1f\ud835\udc1e\ud835\udc50ts_\ud835\udc29\ud835\udc5cr\ud835\udc61a\ud835\udc4f\ud835\udc59\ud835\udc1e_v99\ud835\udfdd1_\ud835\udc1d\ud835\udc2e\ud835\udc32_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92b1949-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764602301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602301, "uuid": "52bda25e-946f-4ea2-9930-60f37b7bd10e", "comment": "Malware payload (Vidar)", "value": "01617795399fcefc5149421125a2a348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602301, "uuid": "4251de91-19c1-44ce-9d1f-0624f3caa096", "comment": "Malware payload (Vidar)", "value": "9c7ad10472167aefc2568e61c592381ea1af9df78da150d9af81c3be1fd93587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602301, "uuid": "6a22598e-2569-40d1-a945-3da945045223", "comment": "Malware payload (Vidar)", "value": "17864273539b590d60968b98d23e83393892ffb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764602301, "uuid": "30e4207b-55db-431d-9059-e9b29ab75751", "comment": "Malware payload (Vidar)", "value": "617de331733b771d7b541c4ab42713cc6a4f72383e2bb65649f51b99c661e362eace4870b12b5b1aeec99c596b3d04e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602301, "uuid": "97d6c5e1-213f-4b60-b72c-024d36c130ec", "value": "T13BD423F0A594F328C79A62F541C768B4D2FB66A4012A312F1FB546B21DA36F1B91FF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602301, "uuid": "5d57b49c-3a53-4389-9160-5f8552810d75", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602301, "uuid": "9bf532d1-14f7-4666-87e3-959ca03fec53", "value": "12288:ZFui6MfcyOl8Lpe+xhZFB8uNBrYDGB1FjzlrRtgHaiVoU+JmPetgV7:ZFuiNcGLbxhPB8uNB0a/lZPjiGU++DV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764602301, "uuid": "92fd2829-9daf-403f-ac4b-03d2c6ebf4f4", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764602301, "uuid": "eac7684f-ae35-467f-a5b0-f8ea66b469a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764602301, "uuid": "5cd62863-5546-4e98-af34-8c91709bb6c1", "value": "SecuriteInfo.com.FileRepMalware.64212946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5401e49-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621112, "uuid": "9e938a74-4707-41d0-a962-6a3580d1dc51", "comment": "Malware payload", "value": "38ce798aa9b8590ceb09a560304d2557", "object_relation": "md5", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621112, "uuid": "1647a9f3-8978-4947-950f-9328b807aa2a", "comment": "Malware payload", "value": "9f06577cb91152242a7ac5d0a1d6358e26406b51cc55bc12c5722d84e2ce6b8f", "object_relation": "sha256", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621112, "uuid": "ed2f464d-dca7-4b92-9625-86d3e1348dda", "comment": "Malware payload", "value": "45ab525d5b054d8518e17c45de0cc9d6b286bf46", "object_relation": "sha1", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621112, "uuid": "5e73547f-83d0-4975-bf1b-8af00148603a", "comment": "Malware payload", "value": "80af56ff8078490d4e741a74195636cd243f794663f9b0a66983725c7d83172e59f66ea3bc671cf6088afd0652e1e38e", "object_relation": "sha3-384", "Tag": [ { "name": "188-245-67-20", "colour": "#AB29E6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621112, "uuid": "dfeef775-a44a-4743-865d-5e0dd072e7d2", "value": "T1A2D633E43C629884C63544F444DBBF37E42B0826DFC781D837C5A24199B3FEA5BA9C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621112, "uuid": "a9bfdc87-ceae-437a-a0a3-b0c7f3c83b6b", "value": "393216:PFMeFMA7WWFRxd9j663XtBjskpXKuT55T5ROA53/j12oy:PFBFbHx6IVswnbOo52f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621112, "uuid": "366e79ff-9db6-472a-a054-f9b61ce227e5", "value": 12932967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621112, "uuid": "05f8b15c-2738-4b9e-8da4-4e74b2e10f31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621112, "uuid": "4f92444b-dbd7-453a-85fc-1bfb95fe7529", "value": "Setup_1764590204792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59282f57-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623078, "uuid": "d33255bf-0a70-46c3-bae6-f4ef251dda70", "comment": "Malware payload", "value": "d8b48883b92bd5059616254bab394519", "object_relation": "md5", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623078, "uuid": "863685fd-fd56-411f-895d-d4d5543d5c5e", "comment": "Malware payload", "value": "9f1ffae375d062ca130a56c3f5fae954745b3cba4d09b2373ef560e90b974f2b", "object_relation": "sha256", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623078, "uuid": "9e0b5ac2-a09d-492c-a05b-f5bdf4253f65", "comment": "Malware payload", "value": "511f739227b00a9f95c070e0bd6e127b530b1657", "object_relation": "sha1", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623078, "uuid": "e6c1d24d-4d3c-4c19-976c-6bd3e951f1ee", "comment": "Malware payload", "value": "500f146f5b2c320f459bece87c184192e6fae2cb8c49a0fc1b133d25a1d13957dcd6666219e12592a186ce8d51772182", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623078, "uuid": "e20e1ba8-c0bb-4270-8cae-4d18cb35399b", "value": "T1AE945526EECB5CB643D3DB53E1E3D61CFE68849C800BADC1B5B886C25860D6A0749F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623078, "uuid": "71b9d657-566c-4067-bf82-2bce4b783000", "value": "3072:q+DNUKKth+gI0hCRnEi76WFzCHRmb8apB:q+5naphAnEi76WFzCUb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623078, "uuid": "dbfbbf90-407d-4e6c-a9d8-eca4b8ab553e", "value": 434893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623078, "uuid": "2aafd190-6ab8-4d5b-90e7-39cb3b8e0145", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623078, "uuid": "8ec759ac-f99d-44f9-bf2e-e1e29dfd13f7", "value": "NvDriverDiagnostics.md.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d983cd-ce49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547344, "uuid": "34d28b4e-e247-454f-9911-6349252cc2b2", "comment": "Malware payload (Mirai)", "value": "fac2fe9110d57c587f3a71a21ea37ec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547344, "uuid": "574d0288-ac1b-40c6-8120-5c257790dd43", "comment": "Malware payload (Mirai)", "value": "a03b2477292ac6e9559f53a20b274d5e2e34b3dea2ca66d437a1483867017960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547344, "uuid": "dc87c28e-97df-4046-8e9a-de7f66b85831", "comment": "Malware payload (Mirai)", "value": "59e69f3fb1cc48fd03066abbd2db96da10d1af7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547344, "uuid": "378e1acc-a721-41a4-a9f9-424a0b2ca5c1", "comment": "Malware payload (Mirai)", "value": "ebba5c7b048967939a696a919e5dd0f0acd1121657453ea18cbf46d9b72136454162d3d6b1f852dfe5b68e841ca58d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547344, "uuid": "b237fb97-4635-4ee9-9863-ef600cc88ac5", "value": "T1F3E3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547344, "uuid": "b07ac3a0-d328-4501-bdda-df1dc7f4b538", "value": "3072:Zbp/QdERKjZyMk9mBeqylnM9G3IqW6L4:Zb1QdERKjZyMxBzylnSG3IG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547344, "uuid": "f73a46d9-fdcb-47ae-8670-08fb5c899f15", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547344, "uuid": "ba6f3ab5-5373-47cf-9e9f-70fc7d3f9fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547344, "uuid": "a275b201-2640-4210-bf35-555aa89548a2", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d670174-cf09-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764630065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630065, "uuid": "d3ea2ba8-9c38-4ee2-9e52-9356aa0b339c", "comment": "Malware payload (Mirai)", "value": "69696a409b8f1be05149ca737215098c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630065, "uuid": "714f8ea5-6e3f-4e51-b865-d0542abefa7b", "comment": "Malware payload (Mirai)", "value": "a0ab1942da9274d876b179a3cc7167fb90918a97c86e7fdaa1a6a843d8813eaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630065, "uuid": "ab44adb2-d38f-4290-a758-e6474a5790f6", "comment": "Malware payload (Mirai)", "value": "aba91cc6b25865d6395c6d6e8c7e13d38f99f89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630065, "uuid": "26d38107-35e9-46c9-8b79-827ebd22a9a5", "comment": "Malware payload (Mirai)", "value": "4691277149a9f5a6137fda74ea31f2effcbc50061c28cdc084cc3827b78c1c303729443ecbe042667cf9f9561028e09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630065, "uuid": "6b003071-9884-42a1-a82d-c4f5d2edecd9", "value": "T13B13E14355B80F80D53121B684FFB703BA61E60D976C88A15A8C693F08637BB6BAD341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630065, "uuid": "ef1eb27f-082a-4ac2-aaa4-3981ea141010", "value": "768:4htOofvQSQWaSgS/6dzgKL5DkHMw7HM0aHR/867vISdbkbR56InbcuyD7UHQRj8:4h4oll2zgKZksgHM0aHR/8SwSdKnouyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630065, "uuid": "dd290b88-e210-4a9b-9cb9-cf1b6993a01c", "value": 42660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630065, "uuid": "b8d9b77b-eabe-4634-a008-586dcefa1c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630065, "uuid": "ec58b4e3-5e5e-4ce8-aadb-8d6c2ec6d4c8", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7932d431-cea4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586625, "uuid": "6b3e585b-96c3-4889-90c5-7a3af04b8ec5", "comment": "Malware payload (Mirai)", "value": "d394e8953a2ec53539a3127e8db824d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586625, "uuid": "efb58320-1675-4a5c-978f-66857fd8adcd", "comment": "Malware payload (Mirai)", "value": "a0fe12b866f9d459cca9a6644739d57a82a75abd69f5ba19f9f64d3fad724e97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586625, "uuid": "36cd593c-2ce1-46b5-bcb0-1e2043ae8440", "comment": "Malware payload (Mirai)", "value": "2e70ce627f88835d411581e670bfe0216bfc4839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586625, "uuid": "11b8f06d-cbdf-4fd3-8567-8e99ed6f2d58", "comment": "Malware payload (Mirai)", "value": "4e02460dd48ff575b075bd720b9dabebc7585aac2ec2933c03cbe0c2deb53b58937a8b5491d999d2b0be30be33fa8872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586625, "uuid": "dc690739-b7ec-48b6-9ae1-ededfa3f6fde", "value": "T1C5C3E095FA535881D1A202FE98C056C287902EB6CF52424813ADF7783D7DDFA0F94EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586625, "uuid": "cbe5bc04-f8b5-4377-be5f-69e1dc69afb9", "value": "3072:z5BKWyFGBnXJX8dN16l8uBSXBgH27gLBAXmMMTnj:/KW7XSdnuBGBgFA2xTnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586625, "uuid": "037cbf83-11a5-40f3-9c39-bee16ab1f5b2", "value": 123736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586625, "uuid": "dfce92b5-8123-435b-a298-ac087bc68000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586625, "uuid": "9c93c9fc-934b-4432-9ad2-69166eedf55b", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec426ab8-cea8-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764588536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588536, "uuid": "1cd709a0-054b-4ced-a2fb-62358b782c62", "comment": "Malware payload (CobaltStrike)", "value": "8a4d6df747671aaf345130d8581cbb27", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588536, "uuid": "ef6f156d-5f09-4b76-97a0-40afd067ea6e", "comment": "Malware payload (CobaltStrike)", "value": "a168bce75d376a04f93143b9d0b93a52cd7e2bdc83603f8ba7d5f8a61f1f1c63", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588536, "uuid": "7312f7c7-1695-4411-b628-d8e861a8fd78", "comment": "Malware payload (CobaltStrike)", "value": "1d4e4f040d4916ac0d895da631ca50a2457f0fe6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588536, "uuid": "b4fbb9a2-ecc8-46e8-9bc3-5da8ea1ab5f9", "comment": "Malware payload (CobaltStrike)", "value": "ba8f0a2de3188572c4fd2cc5744fec6896d870ffb5d112d15ed06fa53d82a27a843e75cc0ab78735c0456ec4ea2870f1", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588536, "uuid": "4f8c94af-5284-47c6-a760-d4eb37433b3c", "value": "T147057D6BEED12A5CC9FF76389E87DB25DBD472809731CB1D18134BC1BA64093851AB8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588536, "uuid": "5e811162-aa76-4f65-aa80-16c91ddcecee", "value": "7dd04fc11a27955f06e37a85d22509b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588536, "uuid": "8fe3a1c4-79c6-48b2-9ec9-c3729bbbe88a", "value": "6144:u1n+CAN1ysZyxiMFLD5rUK0b7NFPXItiIJM/8+VJucu18xg94+irqsNrMTZ3+3NG:u1n+2FLDupjPXItPGVJucIc7f9prL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588536, "uuid": "493f410d-57f3-4bc7-a5cb-be7d2c77d307", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588536, "uuid": "29be2600-568c-48cc-a99d-cd37410ee6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588536, "uuid": "b86f930a-14df-4705-a7ef-f73c4030b9a4", "value": "SecuriteInfo.com.Trojan.Win64.SMOKELOADER.SM.1512.30207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17466975-cee3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764613519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613519, "uuid": "23522904-8f2b-41bc-8c0f-eed772baaec6", "comment": "Malware payload", "value": "b2bac51c648da0bec4a858418b2ff45b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613519, "uuid": "4d5ee71c-ca9b-43c7-be74-4a474e6c6a9b", "comment": "Malware payload", "value": "a1fed92894c58eb43e6e87cd1c19cf6ad0b854fe6c8097823e42545f85b68ca2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613519, "uuid": "4ef2b239-4a85-47de-9fcd-8b860d9af65e", "comment": "Malware payload", "value": "d1c1b0788d5fb94044cd72bed2171a4e4f83d5a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764613519, "uuid": "39830032-102a-4458-af86-40b430dc53b6", "comment": "Malware payload", "value": "32bf8083e80d73925b1452bc893a6ea0c450391f33a93ca5b217666900154b1f98fa8269b31164c6549c7122b49854c3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613519, "uuid": "8d2282aa-f723-4b36-85f4-a3b57c74540e", "value": "T175067D13BCA509E9C0AAA33289A642927B75BC590F3223D72E50B77C2F73BD09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613519, "uuid": "38c1036e-df60-4558-a3f6-e1f78005b1b8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613519, "uuid": "3578f0df-41b7-4e6d-ad9a-4db9aeb91005", "value": "49152:WS0a7p4XWdQAxzNU2o4SCdDHyhXEDj2HKyCj:WhJTWRyE3SKyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764613519, "uuid": "59104720-e5a5-424b-9e12-1292700db5ac", "value": 3724800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764613519, "uuid": "d32f1c04-bb3b-4e3f-aef7-eb8247a2c2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764613519, "uuid": "46ecc923-f8a9-4a9d-8e47-8918168c4a95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257be4f4-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764608389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608389, "uuid": "cc5d19d8-5a76-440e-b8eb-b0375acee14e", "comment": "Malware payload", "value": "9fe417eaded765500ae8f908f0b23037", "object_relation": "md5", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608389, "uuid": "df42535d-49fc-4f57-8ac7-e7e71454f248", "comment": "Malware payload", "value": "a3357684eec66f12d07a9a747725564189f4bc616390d16f1c5e8c5508fbd808", "object_relation": "sha256", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608389, "uuid": "08b97787-eda6-4690-84d2-8422dd0d2cf8", "comment": "Malware payload", "value": "68e850708c50c761296ad9b7bad68d45a2a139f2", "object_relation": "sha1", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608389, "uuid": "e2ef2daa-6434-4992-b0ec-11f12f368cff", "comment": "Malware payload", "value": "fb9b22a0be0981585c21fef1d49b4fd16d7ee9f865fa13cd5ef52ab8603db550d5a5bcfd74b63ea8a610459409230fa7", "object_relation": "sha3-384", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "Alisa", "colour": "#9DA7A9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608389, "uuid": "c7399784-34e3-4971-873d-396c283c9fb2", "value": "T19752290D77C0CFE4D9B62D3AD49B060003B5FB825913DB2F395EB166BA623910A87B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608389, "uuid": "978831e8-59ec-4400-baf6-8d190a65ac6d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608389, "uuid": "6c062ace-1627-44b4-9ac3-f070f0aebeb2", "value": "384:yKq8UZ/uoSamsPuqfs2ezXt626zx7+nRy3By:lq8UZ/uzaFBfs2A6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608389, "uuid": "f2906f94-188a-4304-aec3-cecb8796950f", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608389, "uuid": "d81d0093-5cc8-493a-a9a0-1a18132663bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608389, "uuid": "0814765e-379e-4ac4-b2f5-faf2fffd0b2f", "value": "BLACKHAWK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed0ce6b-ce72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565267, "uuid": "a79ba6ef-42d1-45f5-80e5-4737dc9b3eed", "comment": "Malware payload (Mirai)", "value": "63a6296a098b90bf44c6501188daa62b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565267, "uuid": "3debdc29-28ed-4f24-83d7-9a20483077b7", "comment": "Malware payload (Mirai)", "value": "a3815a27cd85a3d6bc0f097c6fc81b24d0b1556f7dcb33ee9582ffcc09631ff8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565267, "uuid": "5db75a99-0f6f-4406-89fa-76e40a5c41c3", "comment": "Malware payload (Mirai)", "value": "be2601f6e29ea2b841fc1baabc8d9a3f4d167ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565267, "uuid": "82e93158-686b-45c7-81e5-6ef4b29448a5", "comment": "Malware payload (Mirai)", "value": "ccbdf65d970a65d3856a94f6edd2dda9d02bfe5396e86e91fff350f8550dbe4d27dea51a21c87c317141b58f1165ace6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565267, "uuid": "d7965c3e-a026-4d6c-a14e-36c28213856c", "value": "T1D613F1B7C2DFFA05CC0D50B882CD6A192755706AE3949E527E80BA37C89CF3563752B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565267, "uuid": "0691ef60-dbbf-440e-a5cf-0f4275b2a2c8", "value": "768:bI21viALV2n0Z4SiS/EcdafuZMJtSSEVS8/DHr6JKVz7vhQYFHJdnbcuyD7UHQRP:TskmfoMJgSEVlHr6kx7prlnouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565267, "uuid": "9e6b2622-ee6d-45da-80f5-3ee26ab2fb19", "value": 45464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565267, "uuid": "f73eaf17-bd65-443e-b746-4213c3af9229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565267, "uuid": "4a143608-d16d-42fa-9c4e-060111422a17", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b62f052-ce7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569368, "uuid": "8cf6427c-a144-4477-bf71-438bc7307342", "comment": "Malware payload (Mirai)", "value": "7ec60e001e8f70e5f48d23b9a8e211f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569368, "uuid": "f7ad09ac-0540-4f4d-a001-7e5f11be8fdc", "comment": "Malware payload (Mirai)", "value": "a39fd42514a81ccefd17ccd69c6a588d5ef02b14c8ddbfece71e00849c8c63df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569368, "uuid": "659d0ca8-8c88-4671-87db-65f76ee9ebc8", "comment": "Malware payload (Mirai)", "value": "0d0840e7168cc377916226cd6e2d118c729be926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569368, "uuid": "6a4b8d4f-79c6-42a1-b0eb-2834765b7f6f", "comment": "Malware payload (Mirai)", "value": "05a778f3f6a65435ea32e2ae7bc54079b9de9f78b8e021368f6a2d5321ecaa78ab0476c4db12e4832381c2a4fd5c55da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569368, "uuid": "7a6a7d23-26c3-43c5-9f9a-d7b232689bf5", "value": "T1A0B33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569368, "uuid": "8e90a107-022c-4626-8c95-6ed4e6fb14bd", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1gaBwP6Ks/XkmSlx3lJX6s03zxsvAx6XW:eZxMi6xWSaB9jSlLJ6iAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569368, "uuid": "cd14316f-eed5-48fd-a31e-36fe1cee15bc", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569368, "uuid": "61a3999b-d7de-4780-8765-dbdea7247c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569368, "uuid": "1a7d5052-147d-40cd-8eb3-5a9a29b86c44", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866f3d47-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584070, "uuid": "81f53c04-a58e-46a6-ac47-6d7e813a96a6", "comment": "Malware payload (Mirai)", "value": "f6f82b377be86b90a0b32754881e888e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584070, "uuid": "f566d817-f990-4e68-8d93-6bbf199e1c39", "comment": "Malware payload (Mirai)", "value": "a3d70469231c644296239696d435e1c7621f6062069f57060ace0c08f144d5d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584070, "uuid": "e110f9fe-2773-4184-8fd4-7ac35c7c953f", "comment": "Malware payload (Mirai)", "value": "b2db6ba2ca3d862c3775596d4f58ea1d81f02481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584070, "uuid": "15e0413f-75f7-4608-9b04-d6c9538a6f12", "comment": "Malware payload (Mirai)", "value": "b7b89ddeb363e7041b32b54ebc852d7aaf21ca3b514d8e61d47bca6ca755fcf0559d9cb1cdadf52fd2360113d9066182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584070, "uuid": "035e3651-023b-4dfb-bb7f-327ce1502935", "value": "T1766302E0FF09B1F9F4E0DA3390F1058692614E35845BAFE36056F697EEA54D0206BB39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584070, "uuid": "99652e86-b30d-4d31-8965-03a42d90fa90", "value": "1536:qMkbvrpl13t45rISArTyKCKwsWGu63KUTVcd7tH4SrPs:jkbj5yqrTyjBuDcd75rPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584070, "uuid": "0deace05-f7b6-4bbf-b608-889168af053b", "value": 68180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584070, "uuid": "86e3e598-f02b-4ec0-8a73-814dfd30397d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584070, "uuid": "a9f0e8a2-6db7-4ea0-978b-4a72401a83c4", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b7b44b-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621923, "uuid": "4a4b34aa-7450-418d-99cf-890de7c77730", "comment": "Malware payload", "value": "cba749b92acbc226230d65c5b47e7f09", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621923, "uuid": "807152cd-2f1b-4bb9-8cee-6e25565356ae", "comment": "Malware payload", "value": "a421a04d008dca9aadeab91532bad8919be2e55fa14002ee3459456b974151ff", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621923, "uuid": "a4a888f6-03f5-479a-b1dc-897f22317968", "comment": "Malware payload", "value": "d79bacf353d57d5a7ef77bfdcb21946570bac538", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621923, "uuid": "4d44b63b-8f7c-4312-97cf-9ccf64612fca", "comment": "Malware payload", "value": "98a7f4cd730f917144aefab9c7b83851f445f2ccb7336765208d8954a81ba391a31d8c95f504bceb8da90b9a4aa5bda2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621923, "uuid": "c2249bd1-937f-4935-a438-ca0627d11f5a", "value": "T153C19FF8CD009C0D7712922D70D39C98126E834BD5D8BDD9762C40E79A107EBC735AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621923, "uuid": "01dd2b5d-6da6-43c7-b699-a592583e9e30", "value": "96:vlaTPKV2A3QOVokkn7YaI3Ev13vM43s9aKRtNxDYy/zVUb1xE1qFLHuiX4:taTKV2y9aEaIOEQKtxDFzVU1K1RiX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621923, "uuid": "e67983a5-35fa-4f6a-be7c-52b5f0ee5527", "value": 5765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621923, "uuid": "9f2099b9-da75-442f-b01f-b3900168c2df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621923, "uuid": "7e0ab3c3-6b64-4c77-8f38-1163fe285f1a", "value": "struct.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7bb3a-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608742, "uuid": "c759e0bf-ad0a-4312-94bb-66627e9fa34d", "comment": "Malware payload (Mirai)", "value": "086aa812a4e5f17c09a2d32faf6171f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608742, "uuid": "7ed3d806-7a52-4ed8-9b11-842cee077074", "comment": "Malware payload (Mirai)", "value": "a46b86d68844d4dce12d1b6c6201362c21936561d32150bc100ecacaeaed38b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608742, "uuid": "dc43808d-489c-4352-bbc4-ef3451d78ca7", "comment": "Malware payload (Mirai)", "value": "5a915c23489cd2d56d44e374372acc33deb178c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608742, "uuid": "dfb0f361-046b-489c-8191-1ad4cbac1ddd", "comment": "Malware payload (Mirai)", "value": "f66eca160aa951def7a786c2c99b57d7175839e278495b47d51cb01ba7cb8c673a388d3fb39b8c4fd7f4645ae5d7bc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608742, "uuid": "0b04b761-4533-4373-a53e-04e1222dca8f", "value": "T1C013748CF86A673EC3E276FFE78857CE327A07C8678BB626C635025537C9304A525914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608742, "uuid": "33cd12d3-bb32-4250-8f63-006543491143", "value": "768:NOsRsKhc7Il21V32AD9OTq3nEQBn3Ovb4e63FxicBjkcHBHHHHHHHoTn0:gHMc7+sVDqejBn+0nDNS6BnnnoTn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608742, "uuid": "a30734a4-cb9c-4a85-8136-550f4e80051d", "value": 43287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608742, "uuid": "c4afadbb-fa2f-4716-905b-b3416e3483f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608742, "uuid": "bbcb6867-ac4a-4811-9525-01e92207f28c", "value": "niggah.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ea6e73-ce98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764581633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581633, "uuid": "aa739ea2-7044-4c0c-a757-b6cde551be69", "comment": "Malware payload (Mirai)", "value": "68131616ac95f4d683ae90dc50850187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581633, "uuid": "5a0ade48-291c-4b04-994a-84d7f6143d9c", "comment": "Malware payload (Mirai)", "value": "a5608aef729d0a235fe337a389d94cb64d7a682dbd0afc4fa7aaf1836c4ae1b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581633, "uuid": "d1985bc4-8ce8-46bd-8e24-159f5b983bc1", "comment": "Malware payload (Mirai)", "value": "26bebf389aa11858cb9aacbef1bb695caaec9481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764581633, "uuid": "e4f918e7-45a4-4254-953c-180a0761b623", "comment": "Malware payload (Mirai)", "value": "f505ff8b0816dc4acbfc82c5cb67383078fdda90b740d2c1bd1b4398468b3d5b356b2d51926a9c7ffeaff2f5dde9810d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581633, "uuid": "0d4b74d0-f50d-4623-aad5-25f7ef5860b8", "value": "T16FA3D050BB11BE0AC12222F8B0850940ABB16CB55BD7560B8563F9B87D7DCD87F0AEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581633, "uuid": "cf96132e-2b88-4089-a015-bef9f83e330d", "value": "3072:QfgWkkJbGPlg8rGb0c2h75+5nRPMbzkwuL:QIWkkh8i8rGn2B5g0vkwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764581633, "uuid": "103ea3d8-8082-4e05-af88-4d2dbb6b9020", "value": 103608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764581633, "uuid": "6341d28d-4a84-4f77-b7f8-a0c1f7a19533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764581633, "uuid": "55c1f10f-8d51-45f6-b755-7d87d7e5b1b4", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f27870-ce79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568038, "uuid": "a8b5ea93-b6fb-495b-b960-d9d0b58305c6", "comment": "Malware payload (Mirai)", "value": "2c17855b25712cb81647892250e1a8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568038, "uuid": "e404c923-2b9a-42f0-aa91-afe4b75b6c88", "comment": "Malware payload (Mirai)", "value": "a56865c78e62ee946f420c2613600e0f0464b7080d39c8360d1311b5aa9b8a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568038, "uuid": "dc67bf3c-08e2-41da-916c-99bbefe3a03d", "comment": "Malware payload (Mirai)", "value": "ac22a3fce62636a85a26445769a3b62aa6c0bcb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568038, "uuid": "df8ce6df-b6d3-4339-a46d-b5a923382aa8", "comment": "Malware payload (Mirai)", "value": "ff6437213e7aaa6e4211d095c93add52f030a63ba77ea6389e8b09e3cc97b32883fa40b1d1811c2dab376234c6abbbe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568038, "uuid": "cbee664e-0a80-43cb-b6f2-bb5412793067", "value": "T109B34B03B8C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE601B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568038, "uuid": "78b0738f-32ef-460e-99a7-1253d8e44d6e", "value": "3072:emvsrP1O2m3v9yg62bUQ55tGcLlumTThDygHE3EUAH:emvsgv9yg62bUQboYTpHA3AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568038, "uuid": "6ee68bae-c188-4d6d-b68e-07f0d00dc33d", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568038, "uuid": "bd01b3d9-bc75-4c17-8393-695ec1e92b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568038, "uuid": "00b34879-14e6-410d-a2bf-b483ddac0136", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ad93f3-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608714, "uuid": "09608f53-1dd5-409f-b99a-5ee1d68d9e06", "comment": "Malware payload (Mirai)", "value": "9893fd84856db9c42599b45ab7a32a1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608714, "uuid": "ac7147fb-076c-48a0-ab40-e0a66b7f30e7", "comment": "Malware payload (Mirai)", "value": "a604d44ceb3a8a4b678b61f8cb9d5161858bf9b24757ff5feb662a8120c87311", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608714, "uuid": "605f5faa-fbf4-4338-b575-8a3ee32f7d5a", "comment": "Malware payload (Mirai)", "value": "b07875a17dfbe17998c0b6d9153c1545f84350e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608714, "uuid": "d95b26be-4577-4ec4-a4e9-95a6129b8029", "comment": "Malware payload (Mirai)", "value": "3c2540fa2ffbc8644ab7af4ff2ff3d9600f2b18d648538ac49ba3c06e2ec747397591c3fcdf34bc361f7920e03ec3dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608714, "uuid": "369be675-601e-457f-b1e1-b4cfc63282e5", "value": "T198B2D012510F5C60E271007BAE77C19A5A4723FEA2EF76EB1260282CB645C5368FD6DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608714, "uuid": "5d3e1d74-9264-4d7b-8f63-b900db8d9762", "value": "768:O6m9iRonQRGYjJ4Zhw/C77eonyns3Uozk:OsnJ4ACPLzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608714, "uuid": "a5c47eea-8482-4372-9e4e-82c72aeae0a9", "value": 25272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608714, "uuid": "4a8e2ed4-9369-42b6-b520-649c72db99ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608714, "uuid": "6bc30d0a-2cb6-45d5-814a-b38b8ae989ee", "value": "niggah.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42e3aa3-cefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764624090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624090, "uuid": "fb78f037-84ff-4540-9cdc-3ddc90067979", "comment": "Malware payload", "value": "acaa5bcbc1549427d7f911035237d977", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624090, "uuid": "fe767955-d16d-47fb-af51-163a799a6cbb", "comment": "Malware payload", "value": "a633e2038bfa48b2357c52d4fee5fe1000f86c30ef0ab516768de91bab3fc466", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624090, "uuid": "3c87f02f-537c-45ef-b14d-0e2a5d9845d0", "comment": "Malware payload", "value": "47c6b0d14d6a519518d0d8cc0c32c0267c57fce2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624090, "uuid": "d72423e1-e7b8-4945-8b7b-b0908dcb972a", "comment": "Malware payload", "value": "52eb2a8002b32d164dce27c74f96855996865882e050640e8e63f8025c92301b6a926973e180034fca7c7a8d8a6081b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624090, "uuid": "c3bed479-2807-4ccc-9bb5-d1f7d1f9c83b", "value": "T1DC1162CA1121448B4108DD4BB3920FF4F8B14F78BEDE4BA46E8849B583DD39C7875B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624090, "uuid": "630ffc55-80c7-4374-a37b-6e8eaf3ae241", "value": "24:uU1TQiqXZNBLBXs/uqlX/t3qXwx6dVfJP8pvNj4M:NR04Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624090, "uuid": "af479b5f-8827-4583-bd12-d2826da1d980", "value": 1087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624090, "uuid": "9c9c68e5-615a-42c9-b302-92a04cbf6c9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624090, "uuid": "7a30b46b-6bd6-49fa-866d-de8ad72aec32", "value": "fentbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e29f5e4-cee0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764612242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612242, "uuid": "e36c38d8-782e-4688-b52d-4493c53ec131", "comment": "Malware payload", "value": "c1ec9b48a6cf2e070a6b2a4ea301b4f6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612242, "uuid": "b9aed6a0-63ad-453d-8536-15eae495c4a3", "comment": "Malware payload", "value": "a65336f002b154eab29856ce11d363db89fe8c05bcccc5d0e1611bb355eb0b8d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612242, "uuid": "ee44f8a0-38d3-4c9f-935d-742c645e75ae", "comment": "Malware payload", "value": "d3515bd13e7e50f3be4cd4f3bd3b91467f164d7c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612242, "uuid": "7c8badb6-6042-4d00-8c5f-823edee2b256", "comment": "Malware payload", "value": "66218c7684f7ecb2b5fb16bd61862cfe84cc8a8bfa2ed9dfad9d686f1384b3a54a0e0cf6ac550fda42caea33b5218833", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612242, "uuid": "f6af5041-9960-4892-90d7-7869c11ff406", "value": "T1173623237383C37BC99A41704E6A97592178E8F30B2094D3B7C8594DEDA55C1ABBE7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612242, "uuid": "b2b9fc37-9779-4744-abed-9a1397de392c", "value": "98304:1Avma9fQ0x685ErY9BLnCrlhL6vJ3uotrarhto7mSp0IQf:1Avb94nPrY9tnCJhLeJDtrar3emz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764612242, "uuid": "19e536c2-2767-4c96-91a4-db75ce31f51c", "value": 5239296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764612242, "uuid": "71249053-5ddd-4154-b99e-5e0de13fb15f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612242, "uuid": "410e2aaa-19bd-4b1f-9e65-cc1317d1f285", "value": "CarrierRegistration.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f2082c-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608708, "uuid": "a0b1a2cc-b84c-44a6-a61b-5acc46cca98e", "comment": "Malware payload (Mirai)", "value": "6b279378b2769ca4345aa1f3cdebf12a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608708, "uuid": "1c23c64c-f011-4fc5-9f4e-95ec35270ad7", "comment": "Malware payload (Mirai)", "value": "a67d37f7435af3c990cdd597c4bf6bcf9a9e84717ab7e70cfbc0a2d5ee5ddb0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608708, "uuid": "e88e6437-9d3a-4755-bbdc-0e0bc9c4f03a", "comment": "Malware payload (Mirai)", "value": "475fe4f05a966d3d1b4ab9896a96620fd341e8b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608708, "uuid": "4d001d96-aa4a-48a2-add2-2e4e3c04b165", "comment": "Malware payload (Mirai)", "value": "7a94daf98e1b7d883f9b4b6f42efb5e2aee6f03b05472251f30860427b408ac2f7302e3048547d68e908b10b125f15a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608708, "uuid": "3e1a0425-1920-4ed9-9ed0-bc0a571ed534", "value": "T1CBD2D0CEFA49EC8EC86D4CFCC48D1360D5A1B092AB4F4BAD67760CE5D66284937098B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608708, "uuid": "6ae22ce6-41f6-4bff-905e-3d573cf90758", "value": "384:/05T8chh2By3hg+zAe5q8XRPH/oTlF2M9PaFG8ogTQ4rFBrRWGVCz0NvMdH:/Y88h2BCCeAP8tHgz2MIio1rF3WZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608708, "uuid": "06edbff6-e61e-4991-b326-c036e17adb3e", "value": 28916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608708, "uuid": "29eab018-7cc4-49a1-b0fa-7454a8b0048b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608708, "uuid": "8290dbdf-90a4-4690-bac1-df989744b31b", "value": "niggah.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68e7ca6-ce5d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764556207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556207, "uuid": "5e4cfb9e-1411-43ac-8186-bc42b19d88a1", "comment": "Malware payload (AgentTesla)", "value": "24984d596350db4231d39cc1ebc70232", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556207, "uuid": "29b6dc97-065b-4fdc-bc71-7dfe617262e4", "comment": "Malware payload (AgentTesla)", "value": "a6bca360546399b086aeefcb169fb53b0053cab0c35a79cb70c00afb04a8edba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556207, "uuid": "f45c2052-2d8e-4890-8c49-98e41dcfc376", "comment": "Malware payload (AgentTesla)", "value": "9794fadb44c57bb389a36149a2b7f9f0c69f48eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556207, "uuid": "97609d9f-8979-4246-ad55-a69554e3e7f6", "comment": "Malware payload (AgentTesla)", "value": "5eca85414ddba4a0afd33ed731cbd285b41448b7a7665a109dd64425647b193ca570d3aa5d56be0f760e2a1a5488692c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556207, "uuid": "70f89f5f-097f-4b67-b60f-0a9516e542c4", "value": "T12945BF0273C1C062FFAB92734B5AF6115BBC79260123AA2F13981D79BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556207, "uuid": "caedff1b-08a6-4d33-a251-9110b556f83d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556207, "uuid": "2caf8064-9975-44f1-a7c3-e49bac3f5ad0", "value": "24576:/5EmXFtKaL4/oFe5T9yyXYfP1ijXdaHpxNUs4wiBY7+Nn+:/PVt/LZeJbInQRaHp8wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764556207, "uuid": "7e88e8e4-46e2-4bbe-9309-9ff40bfa331a", "value": 1201152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764556207, "uuid": "f07de581-4212-450a-b562-1a3ba2871a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556207, "uuid": "468cb9e2-dd23-46ba-a5b0-eaa883ef601a", "value": "r0008917682_OUTSTANDING_20251128.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc737af-cedb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764610224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610224, "uuid": "a357d047-2541-49c8-b33b-713e0b86bece", "comment": "Malware payload", "value": "8246c42e63ecfdd2db3b218831de4827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610224, "uuid": "2b218dac-c150-4b87-83f6-0d1e5c212638", "comment": "Malware payload", "value": "a6f45077db8550494f81b4623a03ac504e7dd3406d5733adc6cd92830ac2cafe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610224, "uuid": "e15b59fa-5697-462a-ac9d-4719ca7d57c7", "comment": "Malware payload", "value": "9dabb3f568c51f32b4ec341fbee6348669e75985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610224, "uuid": "51f65f8d-d8b9-4ebb-83b9-b1827b3b5f4f", "comment": "Malware payload", "value": "3b0be6a1151e9a44dabf63fe84a510c08a7aa72bb35da5fec5faa1ea76b4c5160a3e20e25cf423cbeefb78f32d9fa712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610224, "uuid": "99890346-e382-48c1-be4f-69d14f9863af", "value": "T1B5542330521A0447D46147BCEBDAC593A261187C479C1EB3224FE697FA7C7AC8B3ABC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610224, "uuid": "8d4107a3-93b1-4d10-91a6-649452052e15", "value": "6144:0lA5/3nCu/55FUQzNPz7grikobaxHKoQ1Jv+Jf3yrqfr7jzBVYNgaN/vY4:wA1XRZxrM2kYaxHyJv+JfCryPSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764610224, "uuid": "16176fa3-12ad-4a27-93c9-451702e57d31", "value": 293944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764610224, "uuid": "523c0e3f-4697-4829-96e5-e2381ce1c46c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610224, "uuid": "911e19e8-10f5-47a2-9acb-08347d2712be", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.54535.23187.13898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc04684-cea2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585931, "uuid": "f1edc210-6249-4e6a-840b-97764f461c2f", "comment": "Malware payload (Mirai)", "value": "b7c7fd79022f860ab9d5149d05c89503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585931, "uuid": "445e1b4a-9894-4aff-ba0f-6de9a1085f80", "comment": "Malware payload (Mirai)", "value": "a76d11d500b4d7983d54add966d3914e40901acaebbe30085e10838426f73f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585931, "uuid": "eb6f36ff-3886-4cc0-8370-f32e0d910a2e", "comment": "Malware payload (Mirai)", "value": "cc431dff587e44acde2b5344a631a9f6c0bfa8a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585931, "uuid": "851aadd6-2b70-4ce1-be63-649097d06328", "comment": "Malware payload (Mirai)", "value": "fb0efa58ffb147eb367e93e081b7ac077067b38727baae6c38fef29dcdd8a49716c73631a5a6f50faaea5f9e4adb8383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585931, "uuid": "46a86ec4-9948-408f-9cae-8630fe2427a1", "value": "T136E3E709BB610EF7D85BCD3B06F9170228CD591622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585931, "uuid": "45b60876-cc5f-4dd2-9b99-f1793b525bea", "value": "3072:JjpvwdERKjZyMk9GBeRDUZraCX4Dq9rG:JjFwdERKjZyMRBUDUZeCX4OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585931, "uuid": "e1f03ac6-20a9-4533-87d3-a1b0d12e9dfd", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585931, "uuid": "a1c615b2-31e1-445b-bee1-6d60b831cfd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585931, "uuid": "5ee27e9e-d711-4aa0-9ab2-8ac994d82c0c", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1180f5fa-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621240, "uuid": "8b2c30c0-81e0-4c05-8f1f-e544a7ea49b3", "comment": "Malware payload", "value": "0a0af6e2f1180bed8ca261c9d20a656f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621240, "uuid": "0697b1b5-550a-4381-9b35-ca2c01aff4ba", "comment": "Malware payload", "value": "a773cd2e22fc5a09ff8d8fac9d022104f8e48c7923a3c6b4d9bf5953e0d40e4d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621240, "uuid": "c4e2837d-5dc3-4173-a5eb-4187bcf2ad74", "comment": "Malware payload", "value": "57145b32df0358552773007924398c13c1563ccd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621240, "uuid": "ba129860-b2e4-4b1b-bc5a-1ef320f8fbe8", "comment": "Malware payload", "value": "133e0124db1f9217f9684c54659abcf822ed61d9d6c194a46507cdb681d39920ea2f2de25d3bdb711b09b922c8e1a9cb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621240, "uuid": "522d98ea-c2cb-4bf1-bc9c-5528de4a7cca", "value": "T156473396EE9CE859E723F436C3784C03B470097066A5E6491B51BD9C4EFEEC1920AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621240, "uuid": "d047b47b-90a2-4908-b878-07498d4dfa31", "value": "786432:W5mpIiorHxYcrVMHRHZG3isbPm6gMkuU6z7E3hTLVJGl7O:WgIioDnuHR5G3isbPrERTxYl7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621240, "uuid": "fc84ebca-cd92-4342-8bd4-8f261a3e2e84", "value": 25217077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621240, "uuid": "e18136d2-ff4c-4b5a-adc1-1d2a30ef9107", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621240, "uuid": "484442eb-09b6-4fe4-bf51-76e50bb2ad9d", "value": "HelloCS2.12\uff08\u81ea\u52a8\u66f4\u65b0\u6709\u5e7f\u544a\uff09.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c027e2-cecb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764603450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764603450, "uuid": "d874203d-a658-4d4a-851e-529476e76a65", "comment": "Malware payload (Mirai)", "value": "f61896129b2f03b245d4e374e6366750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764603450, "uuid": "2bd42f16-8399-4d7b-8496-b0b031a6b0d8", "comment": "Malware payload (Mirai)", "value": "a79fac4267a5e1bc4f6e28732412b3a57562581710be5632d2982845ce39e829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764603450, "uuid": "aed564b2-10de-4075-8c97-2b98854ba732", "comment": "Malware payload (Mirai)", "value": "4870dd9ef6a167edb3f66a798290f560abeaae0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764603450, "uuid": "d4b0f4b0-c22f-4d52-94a6-f6552804761b", "comment": "Malware payload (Mirai)", "value": "19027f44dac5401ad344abae2162b97493d83417f6b78121136ed00f93dff20a02a64b97dd2c7f788a293b4d66e8c4ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764603450, "uuid": "c7ef55e8-1ccf-44e2-aa16-28e53fd5b13f", "value": "T118E4384AFC808B61C6D136B6FB5E82E873471779D3EA71059E144B343BDA96A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764603450, "uuid": "1f62d750-f538-48df-9981-c3c84de5ff65", "value": "12288:bGUSOftZcP67kk2U9ATk4vVLcJA7x9G48oki7Z2DXvj/LYAyaegfqZFPhqI3MSQe:bAOFZcP67WkGEycI3M+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764603450, "uuid": "60d58e94-00f1-496d-9e46-e4d34a2bab5b", "value": 673320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764603450, "uuid": "5994bd2c-87fd-41e4-ba62-d8a658ff7684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764603450, "uuid": "98c5827d-49d8-459e-be36-fbecdc90ef3e", "value": "sync.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85da76f-ce4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764549042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549042, "uuid": "e4f23ba0-4612-4229-998d-8f043a254f9c", "comment": "Malware payload (Stealc)", "value": "9893c2f44b7eb7fa561fc19757a2b242", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549042, "uuid": "cc3aec9c-903b-45af-9d5b-2f63ed594792", "comment": "Malware payload (Stealc)", "value": "a7fb48c17aa6170d742d12441fc1d90de4fdd4cd6d00dfda07aa58d86c9913d3", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549042, "uuid": "4f50871c-7d32-49eb-b8a9-c08c332c259f", "comment": "Malware payload (Stealc)", "value": "d0b8db7bb807d1d2039d29b26338ea988bbabe6f", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549042, "uuid": "418fd623-6e0d-4b76-8485-bf033829a186", "comment": "Malware payload (Stealc)", "value": "cd09fbfc63e70cb1778652a49071755b9ded157a460d08b4cceb27e107fc22331f3a15274f33e602ec16a329a7211213", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549042, "uuid": "3fb6e3f7-293d-4ce4-a42a-678666eaec24", "value": "T1C026E616A9A18AD5D0DBD338B8927283B27DFC070B716EC7194077752D3A3C859FAB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549042, "uuid": "50acfa36-0295-4839-b4f7-b36f2f8a399b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549042, "uuid": "eefca05e-d814-4594-985e-4669fa721ee9", "value": "49152:xBZ4So8lth9hJl09lh7zaS/7vtzgJV4z1hj1H7N5ffd9ZIsRe7a9ahiEyBtXEn2m:xAS3d0qd6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764549042, "uuid": "7c77e381-9282-4809-9890-0de6ba8a5bc2", "value": 4449432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764549042, "uuid": "82d60d2e-48b0-445a-9587-0f8525071555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549042, "uuid": "44696be7-e307-4727-b78d-f49bcd6a8b6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb150ad0-ceee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764618518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764618518, "uuid": "15cd3196-f5ba-4817-8e38-898829436cbf", "comment": "Malware payload", "value": "7d6f96c1c9e15d082ebd7a136a44ac9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764618518, "uuid": "4fe9a28c-3a73-42e9-a79b-5bb3866da2e7", "comment": "Malware payload", "value": "a858736d73d25af0a0bad25fcb658e10f4fb29aa4500fabb03da63a95006886f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764618518, "uuid": "29fb052d-77aa-4e7e-86ec-825a1889007f", "comment": "Malware payload", "value": "5fa10d8827aff9be3c709ba9bf9f7853d9cdc66c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764618518, "uuid": "4d0adcb6-ec68-4b29-ac75-2ec758a9010a", "comment": "Malware payload", "value": "2d3ea5b882e3e297099543f4cec23480fbd4e2a8515cec84082cab544d139966c35c9e0ac591587a9dc21de4edf38aff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764618518, "uuid": "1549ee03-e342-4529-ac42-dc7306da9c2a", "value": "T11B377D91E2C18062F675B0B1582E81BF69216F96472067EFB3D87B0B5931FE26D3720D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764618518, "uuid": "c224873e-400a-46e0-a593-c707ba28f8ff", "value": "65cb0dfabea0271cbfbee44f029b33ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764618518, "uuid": "c7faddbb-0e92-4c15-bb55-627a1bc59f88", "value": "393216:7c5Xv9EjfoBmESeJsv6tWKFdu9C8Ex+M/D/t9JUliUQgjC:7c5X1EjfoBtsM7FLUliUbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764618518, "uuid": "4283d447-5483-4c6a-ad0d-ff01d3658950", "value": 22715392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764618518, "uuid": "492aad08-3203-4380-a00a-ad9f5049cb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764618518, "uuid": "93b0a074-3ccd-4c4e-8819-d8146146285a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcea54c-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583948, "uuid": "49e8c752-8468-455f-8c35-54cf0fd4197c", "comment": "Malware payload (Mirai)", "value": "44d34914c675ba6f2a6b7efa7b421ee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583948, "uuid": "33ac9705-da41-4a48-b440-3ee930d7dfb3", "comment": "Malware payload (Mirai)", "value": "a954ae21788bcced522fbd7e42fd04e0308441404a9fc3aec569b065be29a7dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583948, "uuid": "3a468b0b-03fd-41c4-ba7a-5de218a6fb12", "comment": "Malware payload (Mirai)", "value": "141a2ab27f6285be80517ab227191693aa8b098e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583948, "uuid": "e693c06b-25fe-46f8-b6ab-0fb6af5c3c9d", "comment": "Malware payload (Mirai)", "value": "f8446cf55ef8a59099d80ac8f9bb3e799d93eb22b299a72fefa43c11b890dc517a58afdba0b0a33933cd134b73915f47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583948, "uuid": "016ed2d4-2a77-4533-8f74-50c81f9bdb9c", "value": "T170148120FA0663B2CC720A3897996E5A6E7704559FEB26312D1F533DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583948, "uuid": "539e327a-be66-4b91-8c36-20db34e51994", "value": "3072:SnlSH82Zw5U+T5QxawnK3ofFmtqf3R4wXCsjUKZ:4lSnwB0auSERnlwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583948, "uuid": "3f8bdbd2-6c8d-4455-bc92-2ea99221a0e1", "value": 197236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583948, "uuid": "20d2cb73-2433-48ed-b1d9-fb6e27f6ced0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583948, "uuid": "a3a82d71-f730-4881-bc00-1851d521360f", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b11f184-ce53-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764551651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551651, "uuid": "2e405920-e1ff-466a-8f64-10a0efde606a", "comment": "Malware payload (AsyncRAT)", "value": "91ca18f8951c3f995e7daab36b4e6fc8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551651, "uuid": "3a4b4eb2-f2c5-41af-b018-03cd6ebb6e51", "comment": "Malware payload (AsyncRAT)", "value": "a9adeb4b5083f8169fdc374d2764898e42edecc5e9a29259325433068758d26e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551651, "uuid": "beb2a430-de15-4107-9703-866dd12c65c2", "comment": "Malware payload (AsyncRAT)", "value": "4c6d7f9cc5efd7ae12c692135717dbb70164f7b3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764551651, "uuid": "08a99866-c2e3-4fce-b0bb-6a3fd9c56cd0", "comment": "Malware payload (AsyncRAT)", "value": "b4420f8293768970f02f5d807e7846576a2025d0b82cf3a1f5dcb2942c8eba984c7dc6127f6e7fb6b3cff66c026f07d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551651, "uuid": "a2a89401-70f8-4c3e-9a25-b31306f9040b", "value": "T1DD535B087BD08621F5FEABB5197276060771E6178D13E75E08E483DA2F27681CE907E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551651, "uuid": "cfca29b8-6f41-4884-bb11-f40d7fd2572d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551651, "uuid": "bd0053e6-2576-4292-a056-6532205aac95", "value": "768:0YsFRinPg9X3kU2YVTcMc3qlYztQiVZlxDZFEPr9pK26iOChZzjugp:0YsYg46Ip6lYzFh1FM9o26iOCPfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764551651, "uuid": "d7fd20a3-331b-4b99-90d2-c0400bdf99b6", "value": 65548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764551651, "uuid": "62cfb71e-0ec0-41c8-bbb9-dc391b264dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764551651, "uuid": "0988f26e-3ca4-4939-ab9c-368cf4fa4a4a", "value": "WinRAR.rar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4de81f-ced4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764607460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764607460, "uuid": "224e23b6-c684-4520-9055-370f1bd690be", "comment": "Malware payload", "value": "3498b3d8022179a6c872d2228120411f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764607460, "uuid": "60c5327b-f7f3-47da-bad5-fa0e1df955ee", "comment": "Malware payload", "value": "a9ea4b0e673068a9c8222db51de183b56fc1ed10838a0dd6f530cffe0037c52c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764607460, "uuid": "a407658e-6bb9-4257-9220-4888de4e680c", "comment": "Malware payload", "value": "14d81f7cd3c78ab3d15ed06823319fdbe2434e3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764607460, "uuid": "094578e9-9a47-40f8-8e38-dc0ff4e35c6d", "comment": "Malware payload", "value": "a4498f7e4a59ae6a85c8b7540e1808964f7cfc1db66a30ce60cad3da8d72f3eeafc0b3bbd51e34e4b51e20b3790a3676", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764607460, "uuid": "3038f377-e9ad-4785-b514-16dc633ec1ae", "value": "T12B4197EAA8A16F735D81EF0870230F1D600FA5C656910BADDF6E2C39FEBC90E7014645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764607460, "uuid": "8ae95a8b-08fe-4d24-9624-1c4c8f5ccaa9", "value": "24:z5EMy0MBDCeJ8jE6P1iI3SKXRCyCeyJ3G3oiLi6UgHgugHgivBcBSKXV6/K5m58z:z56VCeaODkCNKNHSH9Pou8GPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764607460, "uuid": "d3b97ffe-6b76-4b9a-94e3-72dc0b84135d", "value": 1944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764607460, "uuid": "42c6f68e-b637-4971-b75e-d655f0e01419", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764607460, "uuid": "2124e890-2608-4650-a429-341fd2976ea1", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32701174-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764621295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621295, "uuid": "e6c4abb7-fa30-454d-86c2-3be07328961d", "comment": "Malware payload (RustyStealer)", "value": "e8f136b9ae75f07409439c95b93722e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621295, "uuid": "30b8aa96-fc76-4113-8444-071ff6fae01a", "comment": "Malware payload (RustyStealer)", "value": "aa524d9e1ebbcee41f7927cfe90f9db9fb846005be4e05ded2da3f0943db69c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621295, "uuid": "8f5b04ed-5ec6-4ae8-a46c-617c035864ee", "comment": "Malware payload (RustyStealer)", "value": "79a2b170488b50c27ef187fdb15f1f9a32ee87d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621295, "uuid": "38c8c88f-907f-443d-a196-07888dd399e1", "comment": "Malware payload (RustyStealer)", "value": "98a8ce6bcd18c5cc89dd1f3ed41516a97b576d2ebcd6beaec35d28d368d1aa90fa2a6bf437483ee70b75a8701470ee5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621295, "uuid": "607369fb-5382-4b9f-98a6-46ed2fd23810", "value": "T19C7633F7B811E175E975D33BB18598E123A1587C6FC4E6B13F1E82FA0939AD2C8A4503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621295, "uuid": "1b972f8c-0242-4aea-a5f5-5512e62d7f91", "value": "e9a28206c4d79fb765568211fdb01290", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621295, "uuid": "bc02e5f0-be1c-4e8f-9138-e644b241dbe5", "value": "196608:BhT2N70AloFtHXx9D/rlz+f2i4XKEQvTjhCf2:6N7tKHXx97rZ+f2iuKEs/hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621295, "uuid": "f7a9c1eb-c35b-461b-b601-d8e5daec846e", "value": 7288712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621295, "uuid": "d0fc5028-c130-4758-84db-0bedd41f8124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621295, "uuid": "9e1027e2-32f2-4fd5-92ab-32aca055a238", "value": "rhsremotesupportv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eabfd6-cea7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588122, "uuid": "84891b0d-7395-4660-8bad-9991c52e7209", "comment": "Malware payload (Mirai)", "value": "d128ae18fdd98b8564f19420ae8d50a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588122, "uuid": "3e2da9f5-a007-45a5-847f-d849b0e6bb33", "comment": "Malware payload (Mirai)", "value": "aa661eef247ea9e6d62f556d831449cab1560e514c4353681057d8b3be32b2be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588122, "uuid": "9bd945b8-2577-458a-b40e-745e28e1e18e", "comment": "Malware payload (Mirai)", "value": "ed5497046302f22a260bee422d0eb7697ba26d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588122, "uuid": "c8ec52d0-c474-4638-ba34-a140ffe6cadc", "comment": "Malware payload (Mirai)", "value": "1d492f3b73411d948397191d7b193d9138e8ee58075c38e02c44bc636a6f621227c3da900418a1c7350cbaf9681a758f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588122, "uuid": "c91739db-065a-4083-b8c8-70f9f8e6ff57", "value": "T157630233692634EA13305D3BFCFCC795FEAAC26AD45D3172742984783546F82478BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588122, "uuid": "942884b4-d2d0-46cb-8ea0-3b4a0aa6d8fe", "value": "1536:8YWnPpMi9HTx3/zDn9fZcH1wRFYef0Nrk0gLJ6qxXXDvNdI9AEqRVT:8YWBMUTRM1wDYef0NrkrLJ6qxxdI9AJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588122, "uuid": "2ef65ebe-4778-4e12-bb8f-9db5584b96e5", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588122, "uuid": "243bb1c6-3dc6-42d0-8a59-f73c69a14881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588122, "uuid": "86e4a3b6-3cbc-4ad1-b645-b0ba4d000ca5", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932b2360-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621028, "uuid": "2a63184c-fc38-4748-933f-e1db021c16c5", "comment": "Malware payload", "value": "eb713989d80b6e99da99461a3a80a7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621028, "uuid": "0edd0f0a-068b-43b9-8297-29c6cc505a30", "comment": "Malware payload", "value": "aad9cb4486db41c4341099ee45be64b6ca7c5d34ea8bdee81e65dceee6376d29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621028, "uuid": "a2aed694-2aac-4497-933c-329a73baa3af", "comment": "Malware payload", "value": "e40b5f3c3c42ae199b96ebebe90dee58343e64fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621028, "uuid": "6bd94027-c167-4827-b1e7-a179fe3a9550", "comment": "Malware payload", "value": "52c9580287bbb734e8c6684534ab17dd271f65ac9189de4cad5089e0a1e5298d22b48cce64a43f51111137d689778877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621028, "uuid": "d2418714-f03d-4194-b58f-cb89d903ef42", "value": "T1340733B609F162A6CCDEA2B1182225C75145A737FFB3203AF2672FB605E4477F352825", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621028, "uuid": "9fb83e59-cde4-4472-8db8-1ba3b10125eb", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621028, "uuid": "d5ecd149-ec86-4d29-a833-314596db6b6a", "value": "393216:m1nfYcH5b0IoFjALQVB2T38+WJ3vXS1InTQxtlEf9Zo+g:mdYcH5b0IZ0iT8vJC1InD9Zo+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621028, "uuid": "2eb4b9f9-d5f8-4b4f-9015-c9edca7c6579", "value": 17660416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621028, "uuid": "fcd0c6f5-91d8-4b5a-8539-93442a450ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621028, "uuid": "2dce918b-ad80-4c58-a86e-b17ac8cafef2", "value": "Installer_v2801_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43989947-ced6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764608010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608010, "uuid": "b2498c20-fd16-4731-9ce4-3f722d576a7c", "comment": "Malware payload", "value": "f31a7cd4df7a45c86aa82184cd352174", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608010, "uuid": "b4e8275b-7444-4a36-aed3-7361525c440b", "comment": "Malware payload", "value": "aaf95f1cd7a0fa3dbfe0a180066e2415cb5605f643c70ed1dfd063b5ebb72241", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608010, "uuid": "d4779678-28e6-4754-bd49-ed6472f8041b", "comment": "Malware payload", "value": "c725a399a786e52eb3baf52e65fe062aff3f9e6e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608010, "uuid": "5cdec4f9-f1b3-4d49-855d-1e3cf01ff09c", "comment": "Malware payload", "value": "7859b103a1d4825e6cbd0d104203b758e706b881fe6ad54f836f17b364cb7c595d48b6c32c9558cec101ecfba2f9fd73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608010, "uuid": "09602951-efe3-4fd4-82dc-dd6a9500a866", "value": "T18C3622941CD6432BD29D8D337939F6A412030DEAA3DE481ED069BFC35EE898C099D17E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608010, "uuid": "2282574e-d4cb-49d7-ab77-6c246585e041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608010, "uuid": "bf406fec-d7d4-40ba-b513-6581438d7133", "value": "98304:ps9TzD9N0r1QhqSUoHMleeB0eq9/lVfcK+rB3eAefncuxDKQ6Lmo:gfuQZUoHmeeB0JH0nebfncsDKFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608010, "uuid": "40073397-92ab-4576-9ebc-17c2ea030c35", "value": 4929024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608010, "uuid": "664427ee-a610-4577-9154-39b12f6201d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608010, "uuid": "5661c545-d3d0-4843-81ea-7ed58cecaff5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000ff92-cee1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764612996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612996, "uuid": "9996516b-8d18-49a7-949d-ad789d5a8d20", "comment": "Malware payload", "value": "013ac0aa2047ee4ad692300bf1f8a50a", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612996, "uuid": "81e883ad-01ee-4f77-b809-3c985286ad0d", "comment": "Malware payload", "value": "ab1c3110f6d0c9281bf7b0c189fb8510c8ec4d0905682937abaca665b259dfcb", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612996, "uuid": "b6d813f6-8c05-44cc-acf3-ff20c63b27dc", "comment": "Malware payload", "value": "e2499c7490334ce8bfcd763c4969c4c53eafdefb", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612996, "uuid": "db93f8fc-d54c-49a2-96ab-b22af5d26aff", "comment": "Malware payload", "value": "33feddf4692a675d9214be0304456b20bb10c7a456fc2b01e57e132e8920f4c81b312bfc6e98c919fb6679816d1cde14", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612996, "uuid": "45f54017-b39a-49bc-90f6-b902f8618458", "value": "T161052203A2F530FDE5B786B484506655EB73F8BA46B24F5E03A042D91E63AC18D6EF30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612996, "uuid": "4e5b4d6d-02a1-4913-94c1-1580d25fe810", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612996, "uuid": "cda5e896-ae8f-4100-86dc-23c72f9507e0", "value": "12288:vX04BF/4Mev8MUElgx5nqPjCNnUxGwb1uGLn37ceHwck5n4dyvL9UYlvVS:vEqC8MUx2WKxT3weHRk54dyBhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764612996, "uuid": "839a4187-5582-4c8d-b9e7-eff4f7b072f0", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764612996, "uuid": "fea861f6-9d50-4010-9160-7a026ac61131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612996, "uuid": "626ff0c1-e11b-4871-a49e-ddfcdffa8337", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb32cb2-ce73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565724, "uuid": "4e465b6a-d447-41cd-970e-aa96374a4254", "comment": "Malware payload (Mirai)", "value": "477232dd560589c8fc1993ec7bbfa527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565724, "uuid": "45369df5-a200-48aa-8b94-39a030db5810", "comment": "Malware payload (Mirai)", "value": "ab2941f4781a5fdff78181e878fe8b065e5decd73a1949a99b12b724934cde58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565724, "uuid": "1f1964fa-71c7-4eec-8bb9-b0c45d20ee2b", "comment": "Malware payload (Mirai)", "value": "7e185c857fd11a55788ae0422a4533624fef32ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565724, "uuid": "bc505009-333f-43aa-ba37-597f4aada828", "comment": "Malware payload (Mirai)", "value": "12a4f8339f247b276b1f478376797b8135403182fe65267c468ed4b33860dcbaf9e6091cdbc9bd87921d15031fed4dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565724, "uuid": "8bf117bd-59aa-47b3-b4bd-9d1f4869ab2c", "value": "T1B523F26D14867CF0D77488AE929B049815B2EE78C7EF37B72E0665B85281C421FACA71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565724, "uuid": "855d3e40-6f79-442d-9a9c-2d2533f8630c", "value": "768:wx/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg47V7qwnJbqzquNouFs3YpmhV9q5xH2:hnoTBJKY6xeTsWWelpqSbqzVrs3YQn9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565724, "uuid": "332935f9-3d81-478a-9ef1-9777c5e5d3b8", "value": 47380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565724, "uuid": "57304618-9dd3-43f9-bad3-a59e77befd49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565724, "uuid": "d9ba4337-d441-43c8-a6d3-9f867f031a98", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2d0e2e-ced3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764606925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606925, "uuid": "830afccd-df01-439c-900e-66cf34ba2026", "comment": "Malware payload", "value": "ad1926022bfc081675d5bb27961e32c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606925, "uuid": "9f1563c2-567b-4d36-b991-1f725d04849f", "comment": "Malware payload", "value": "ab446082099ea0a8ea03ff67eb5a8f257d9a564ff39dfc3e2574799a2d360cca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606925, "uuid": "aba7db95-d476-48dd-b873-4db80b01c5e4", "comment": "Malware payload", "value": "034b5e3d86e8fb2b11ea6da48cd4d74f73bb4132", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764606925, "uuid": "bed44d75-d3a6-4146-aef1-0f5eed481502", "comment": "Malware payload", "value": "002759c6e545976f761edd974521b3467e6e31b2967d5625cf0ddfd93b11d82f052fe5dedd25f29677b555d11622beed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606925, "uuid": "f2062311-0bd0-4e54-b2c0-2198b21bf374", "value": "T129B092808229009E0C288004246838A06908E220A4904EEDB6646C72443C643B981701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606925, "uuid": "c874063d-f3f0-4e06-87ea-3d83bf50ec59", "value": "3:TKH4vGBwkSDk3LWEXK5jIQ7hdFJIQTKCiCiIQFYWn:hBDCSI6I6AIQYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764606925, "uuid": "501eeaa8-51fa-4a14-9660-e0391a5dae7d", "value": 99, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764606925, "uuid": "9988974e-d0f7-4dbc-a56f-b10ddf6ea9be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764606925, "uuid": "ada376b4-6935-4261-b3ba-e13abd437ac2", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da9e56d-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622978, "uuid": "45f1027a-cd5d-4dbe-bc02-8e58398da0c2", "comment": "Malware payload", "value": "e03a0e32a9c38a6776c8eb155c0d3b78", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622978, "uuid": "688d8d09-d133-4057-816f-1c06cb40e8a9", "comment": "Malware payload", "value": "abe1128725ef7bd1f85a55c90baba85d5775785664509662c22cfdee78f94f12", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622978, "uuid": "dab7b3f2-ae0e-4d52-a649-4cc9c5d6abd4", "comment": "Malware payload", "value": "823faf78b47ccf05d4406f590d6619c8d6aa0074", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622978, "uuid": "7eb7fbed-2fc7-4d2b-b36c-331170d700ec", "comment": "Malware payload", "value": "2f92d0be1ec5550b34e64529929f61d3443d2b7f8aea0657d97b16afcdade510afe509799e2291e1c160a34f9d482a45", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622978, "uuid": "4d9708e4-9c3e-4ca5-b221-dfbcbf215669", "value": "T1E6B6332B89EC6763FDCF34382590CA685A6C4346B24AF85A5E0F41E06DE3D785B2E41D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622978, "uuid": "32eed719-2c7c-4cb1-80b7-df2d601d0876", "value": "196608:wgAU5w3RZoz6KCgZ9scORN8g/k/TH1CSgk08LEaXVAPoSObwdsh8p73qVx:wjU5whGO/csWg/q0QxWPBGwdshEYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622978, "uuid": "21284720-4b96-4db4-9fbd-1950825ed0cc", "value": 11322067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622978, "uuid": "317f49c7-b9ba-4e58-8c84-b26d772a3638", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622978, "uuid": "62ed44d5-480d-4b77-8325-1e7968b908c4", "value": "app_permissions.md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cf5f2d-cedb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764610275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610275, "uuid": "96899e2d-6fb6-4da0-8d36-32362fae2d50", "comment": "Malware payload", "value": "a70019d3fd522da4a00fcb5e5edf3da0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610275, "uuid": "7b2522f8-b222-4b5e-8d1b-544c907b11c1", "comment": "Malware payload", "value": "ac6c0396b5299d60d3574a54b075f3fd7bd984725b080d158a5331740af614f9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610275, "uuid": "cbd6dd03-ef99-4d85-aebd-7b3271f455b4", "comment": "Malware payload", "value": "7efc35b1d1a70d95b7067abd67831fe1e7f99126", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764610275, "uuid": "617dd6a1-1ddf-4354-9140-ff3385a68861", "comment": "Malware payload", "value": "e1628969b38f6893fd730ceea57a649cb069a9320a797b36ddb8cf09af1a57d90c6c0807a82fdf996841005c4425123c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610275, "uuid": "f6bd327f-398b-4708-b398-0ea79d0a76b6", "value": "T126D68DA47B003DE2E16FEA36C9A359951F653D1D4B76B6CB0C60729E0D733A1ED2AC04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610275, "uuid": "ed970f61-1bae-404c-a395-5e4bf113dac9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610275, "uuid": "6ab6e273-86bf-42fd-a9f9-53e66dbfe984", "value": "49152:gtde3eqJnC1VoYx67bFQCu7/YZbN2T4I71RB58YTMcaDghTK5tJXjarsZ0JrIXbp:gte9X1b8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764610275, "uuid": "cbfe3588-e363-41f7-9e8d-a35d85f5829b", "value": 12704768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764610275, "uuid": "cc63f913-62bd-4c9b-9fbc-dd286e6e57de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764610275, "uuid": "6d92a8ef-8386-4a8a-af92-115f067db0cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d6a3aa-cefa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623776, "uuid": "d7b18db2-748f-4bea-8614-d12ae33e8486", "comment": "Malware payload", "value": "0a4e9e9eefa7f11190b7a58adae63b76", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623776, "uuid": "435dea4e-1641-45e1-bdf7-b0be88cb4adb", "comment": "Malware payload", "value": "acde16a28e9271c5f50dbf3f643f12fa2959008986e39a7783d0b76beab95bf2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623776, "uuid": "ac404c93-d3cd-4ade-8cd6-4833789709e9", "comment": "Malware payload", "value": "7e19b8610b963a88552c90b61c03b514582289f0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623776, "uuid": "80d9dc46-0bbe-480a-83e0-03e2ca42b60b", "comment": "Malware payload", "value": "752a0e95edff8a0e1b5c1d0922f290d2c9923da78592e724577c5c60a021170298e63db2502a265a0ce781476807b0b5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623776, "uuid": "b3279c7e-1f7f-42c2-a00a-87f11080c739", "value": "T106512B7EF1D61B1042100C70A43AEC525395E9CBCFB80C47F8E591D69EB5358DEA01E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623776, "uuid": "e30fcfb1-1ddc-4028-999d-acb179d245ee", "value": "48:P4DY777xMKXsSteiu5gXdm4jZZJn7jlxtarXQdXAEYtCtXt1hw:P4DPSteiu5gXgIZJ7j1AXQNvm8dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623776, "uuid": "bbfc9925-fc56-4a95-b20c-421c54dbe722", "value": 2443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623776, "uuid": "4c849410-991a-4382-8a7d-e0087ecc9990", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623776, "uuid": "9be61603-be15-4f9c-8947-394056e95fda", "value": "SystemUpdate_3082.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724c04f3-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578023, "uuid": "e8005f0c-c560-4bde-9e55-831c62900911", "comment": "Malware payload", "value": "86979716a56703232335f853ef1dd909", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578023, "uuid": "d3baea2f-fb64-465e-a565-6de399cebb0b", "comment": "Malware payload", "value": "ad1ff400fc41f8c697a449bff1ec725211085f6874ebc714b01b80fef863c790", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578023, "uuid": "29f4c08b-6bcd-4187-a97b-56b8fd33170b", "comment": "Malware payload", "value": "fde60a7277aed856afa1d9421ec88ee815f719db", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578023, "uuid": "c38dcf55-7de8-4f82-a0f5-39dfc9003cff", "comment": "Malware payload", "value": "b4fd917c916051a1a4f117559160028a978cbb713e166cd7afb238ba7702252de1b367e858f4a018be8da5effbfe97b1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578023, "uuid": "55582298-7a04-4630-a76d-4e5a5a5f55a6", "value": "T1DE26EF86F758AE2FCC7740320DAA5231225B4DD68E829B877944375C78776E80F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578023, "uuid": "79bc8417-adce-4f48-ad1a-fd04df887546", "value": "98304:1h+XsfOHoJYN3iY5cozxumVHA4eQrbQzompi0nd2ZrdTe0:1h+X+QoJ23iYyonVn3rbUppI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578023, "uuid": "65db31f4-d388-405f-9021-1d78ec2166cf", "value": 4458043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578023, "uuid": "e500f694-c5fe-4f36-9876-1ef52e60bb86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578023, "uuid": "846b5dad-ccca-4e5d-947e-129155470046", "value": "JuxQEdYA-pin-up.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34036b28-ce7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569329, "uuid": "ed3e8a09-e48e-4d3c-95bf-b4a19f896f9b", "comment": "Malware payload (Mirai)", "value": "5759b0ea7c7c7b382736945cfbdd5d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569329, "uuid": "7ae9c504-f880-437b-b79c-6989ec1596ef", "comment": "Malware payload (Mirai)", "value": "ad35e54d70a4cfc75e6d9cf018b6548a453735e191ddd413c6b856b4387bb0a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569329, "uuid": "76c5d928-8a5e-4dbb-812e-d9e30ea8eff4", "comment": "Malware payload (Mirai)", "value": "e433a9b7100c7838b856eadf51b32be78a89e4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569329, "uuid": "9af2fb26-333c-40dd-b7b2-a2411f51137d", "comment": "Malware payload (Mirai)", "value": "4a6d4adf1360d5d2f2f1ff9d257ffed44bbd94a7a7472f07e5042da44bf5d334be3bc38b580fd046ff6e606596f142a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569329, "uuid": "ff791e7d-4149-4514-abc5-d778a188d486", "value": "T17023F16240AEF76CD67C96B996FF0A48307BAEF197963252040151EC33C1E096BFC5D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569329, "uuid": "27d5571f-1ce3-4d13-8b93-c31e4fa5dfdb", "value": "768:tx/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg4E46eJCTVhnYrXxowN0Z5IDOEgaywi:QnoTBJKY6xeTsWWemFCCTXnYN0wVBywi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569329, "uuid": "0cb6a01a-879f-418f-9f3c-2f4cfb13a6c9", "value": 47380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569329, "uuid": "7517e069-4461-4f80-886d-d898154418d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569329, "uuid": "b9e6023e-e98a-4d90-9f69-80ea4d38e0f1", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa64d5a9-ce82-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764572104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572104, "uuid": "9abab18e-422e-4121-b513-ccc4a2d97270", "comment": "Malware payload", "value": "0d20c89f08e061f9883cc159d92ee52b", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572104, "uuid": "68d4f1f4-c56d-45b9-ade9-1ae46ae31c65", "comment": "Malware payload", "value": "ada1dd0f7e4fdb853b5272f38875b80988a8cd6335e3cbdda0b17bb0acaa314f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572104, "uuid": "60fe5108-4769-4f25-ba39-a72e8b885b8a", "comment": "Malware payload", "value": "ef0b1eced569abebb93c1265934e39ad19cb24d4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572104, "uuid": "27076220-bd78-4c75-a6fb-a41752d8cf95", "comment": "Malware payload", "value": "8ed376c63fda44286eb2b9d71dbc0e8b184a0e3d35c86273d66b80cc04380dbce0beb1f1fff492d2408385d2cb13446a", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572104, "uuid": "6dfcc64d-8b9d-4672-88d1-659c874f0608", "value": "T140E42233AAEE3CBDD06CA5FFA91B35B038A94E445A71750A498B63EC5D4059F0A101FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572104, "uuid": "66892714-1e8c-445d-b00a-0aa5110c4631", "value": "12288:juHgnDhA4F9WKLo4GID5t7LtuKAi6uBbObHniNylI9S328sM1xH2E7zGvmLd5:j2gdrFt1jVBLtuKbBCbHiNyl1NF2E7z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572104, "uuid": "0b39c458-a7dd-40ee-bc14-06cde629997d", "value": 677282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572104, "uuid": "e5bbf5ba-2011-436e-9152-d624f37eac2c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572104, "uuid": "2fcc4849-2e71-4112-ac33-f5905ece3c66", "value": "Order POP250007.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2e6887-cea3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586039, "uuid": "74e0168c-6189-40fa-b348-69a01b7331bf", "comment": "Malware payload (Mirai)", "value": "43e825ca1aaf1175693a5431786b8ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586039, "uuid": "36dd8278-8b0f-4c99-9e91-4194ebb30f1b", "comment": "Malware payload (Mirai)", "value": "ae98bedb68cd94e049ce089f8fbebca1a593c29ac36b9c0ee66dfd568f086603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586039, "uuid": "497b086e-6a22-4648-a6ba-41ea32f370e0", "comment": "Malware payload (Mirai)", "value": "b426c91b3d0508e874115a0885e1a34d684d1ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586039, "uuid": "e4b93a8c-8251-4a72-915c-87a9b65a15fe", "comment": "Malware payload (Mirai)", "value": "4140367e3c6bdce6d81c6c9cc7ec33075e652983becdf9852377977e47ca93ca732679f29a3ad739ba8f838e25bedab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586039, "uuid": "32b29874-ac10-4377-861a-bf6719824686", "value": "T1E7B34B03B9C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE600B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586039, "uuid": "586b88a2-42c3-4272-ba93-ad3a7c820023", "value": "3072:emvsrP1O2m3v9yg62bUQ5itGcLlumTThDygHEDEImC:emvsgv9yg62bUQsoYTpHY/mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586039, "uuid": "7080c9c1-ef4c-4acb-b7f7-53873b732767", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586039, "uuid": "de6f7061-9f6e-448c-9b4f-62789e24fdc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586039, "uuid": "51da23ca-a245-4419-b0b2-ba0e5b69d379", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fae7dd-ce4a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764548100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548100, "uuid": "323ba1e4-30a4-494f-adac-1a7c992242b3", "comment": "Malware payload (Mirai)", "value": "e5d9e349acb9a608c5eaf14510e87bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548100, "uuid": "b606110c-91d9-4ad2-af69-85297b438c79", "comment": "Malware payload (Mirai)", "value": "aea0a2154745c6a42ace083a8a7a9ef7226b9f7e74533f94884b31594423bdad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548100, "uuid": "491642ad-87a4-4bd2-8653-8dad4566281f", "comment": "Malware payload (Mirai)", "value": "1f37806633c3ad17bb8063af54bb5ab4efd36cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548100, "uuid": "f22752cb-9cad-4dbc-95ce-6b9260c39ad5", "comment": "Malware payload (Mirai)", "value": "77091f7d2beb8065fd853af2724862686fe0fae3c696ff3ac913bb967df4181a7dce491bb58e40d5c84576232beee1d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548100, "uuid": "2d7e876e-ad3c-4ef9-b5d0-9dd1f5ef14aa", "value": "T1F593F651BC82562BC5E423BAE6BE668D336477E5D2CF722BC8214B107B8561F0D63F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548100, "uuid": "415db0c1-c4a6-4f33-8410-9823287977af", "value": "1536:+UNd+ARioV9qo/NYmMOy44NrQ6geUPfcpPJc8LA37fwZ0br9nE:r+AZV9qPOqQUJy7fwZk5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764548100, "uuid": "9c9682d7-0807-45d5-ade5-1e8fa23aaae6", "value": 93812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764548100, "uuid": "c0b54727-f020-4ba2-998d-8971f45a47fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548100, "uuid": "75c93f78-782c-482f-98d3-01bc8c1f06ac", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a87fcb0-ce84-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764572776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572776, "uuid": "f90edbc7-39d8-4793-b90e-58f3fb6d5ab6", "comment": "Malware payload (Formbook)", "value": "717fa0b1e299e45687a00400e8222df9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572776, "uuid": "d747e088-4d9a-43f7-9b35-21f924cd0866", "comment": "Malware payload (Formbook)", "value": "af32cae214bbe68054bb8386d8b631d189457841e695ff1a8b6783007ccdc98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572776, "uuid": "f101ac89-4968-47c1-9a3d-273011e1d9dd", "comment": "Malware payload (Formbook)", "value": "9d1784039d00d784244f1d0572ecebb0cd15bf40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572776, "uuid": "86a91538-9c6a-4924-ac1b-3ffce0398cbf", "comment": "Malware payload (Formbook)", "value": "c93a239d3675b985372642cad43df76431a0a770ea1b78ce7ca1d78cd69301ca26c4d99763baf329ab77225738ecbffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572776, "uuid": "d311bc94-13a8-4c7e-8b45-7a38e575c89d", "value": "T156F412170694CB13D12247F92973DB74177A2F0DE452E6AB8EFA9DDFB9203248C4835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572776, "uuid": "1a7369c7-c53e-437b-9cc6-5113fc5675d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572776, "uuid": "715484bd-c08f-446a-b812-06a30236116b", "value": "12288:H2iNhMM9s/YFWJx1XB1T5EOP51fpF9RNSFm8e6Q+7bBCYjuv5x1s/CPoWRfQXTja:H13fs31xr75RZvNDoXBCYjxCPRfWzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572776, "uuid": "4c78c103-6224-4474-81ce-bb7e5d5e229c", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572776, "uuid": "28ea8235-de49-47e5-bd65-0b6d9a8f36e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572776, "uuid": "db5941dd-b617-4341-a5d2-94e79efc2cfd", "value": "Request Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f80eb3a-ce83-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764572274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572274, "uuid": "27212867-fa83-42de-8aeb-678d75de3b6d", "comment": "Malware payload (AgentTesla)", "value": "b304c82e001d4919c84c68ec06379eea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572274, "uuid": "b05e1be9-db42-4382-b3b9-e70689972722", "comment": "Malware payload (AgentTesla)", "value": "afd2ee205e93347b0529c6b002a754d6f8c6452df0b0e664ddc8b847bf35daea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572274, "uuid": "893e4c17-ac84-4056-82f1-06f9c2549b24", "comment": "Malware payload (AgentTesla)", "value": "aea278a47d2e72b38f01ebd4ccdfd45e5602eaed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572274, "uuid": "72a354c3-8583-4dc6-aaf8-9399bcb2576b", "comment": "Malware payload (AgentTesla)", "value": "800b01759579d6af428eedfa21707a2338832f649ccf086a236143689d0dea34caf6f814abb2f6e1024c56b2d8bc2062", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572274, "uuid": "29bb2fb2-4763-43e6-ac82-5f7ce01c00e0", "value": "T156F4535273C0786423475B3A772FF0E5EE1B88E87658044BD126BCB0A67D71AEED4932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572274, "uuid": "a32c8232-92cc-4cb6-8572-c6bf9dee4d4d", "value": "12288:ru1jZtGk1auRi2uigtwpNpZHscN+OB46ZR/l4yNcSAQhdKZO0:ru1jZtGk5i21scxSy4yNs8dKZO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572274, "uuid": "ea900dfa-2fe0-4019-a554-a7eafd765139", "value": 771986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572274, "uuid": "8b613c57-d9e8-4d05-b702-de3b3b5ee46c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572274, "uuid": "e9331a44-e7b0-4144-b47b-d02ac98c8bd9", "value": "HG987656789000ROL.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1364b59-cf0b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764631011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631011, "uuid": "4802d24c-9cbe-4b47-8b52-8071cd681e58", "comment": "Malware payload (Mirai)", "value": "c223d4cc0bb11635a03d12598ab510cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631011, "uuid": "17f70a49-3df3-48cc-9b50-00710ff66914", "comment": "Malware payload (Mirai)", "value": "afe0ecb43e6061f921d199ed69d58063599ee4688885c061b68d7d1119a39cff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631011, "uuid": "1c0b84ad-cbb8-47d2-83cc-eeedda9aca0b", "comment": "Malware payload (Mirai)", "value": "090c1d5bf9d919641f97ea5ef59a9ed8a876c84b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764631011, "uuid": "86555ab2-5da9-4b12-ae74-76c2a607e272", "comment": "Malware payload (Mirai)", "value": "adba3e55b8354b8d91a26491503c0cd601e409cd821a8ef22fddc688ff86c9748d8b50903a08b1ded1107faec09d20e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631011, "uuid": "3c56aecd-0b29-4077-9fd9-1891d1950efd", "value": "T1F513F1F6A0B9D474E0E412B34B774BB0BE99A911E72BD7F344CE31BA8849E32B450601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631011, "uuid": "1d8f0395-d939-48da-a872-c46e63482cc8", "value": "768:MdPIWT/3I3DCySl7yFqFkDgfgP3iITrKNRzB4RC8mre9d1YbFKQ95xdoMx0be:MdZj3I3DZSJ34PSICjzmmriLYbFB95xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764631011, "uuid": "cf9a4fa2-5278-4e2c-8f4d-b3dcb83ee2a9", "value": 43468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764631011, "uuid": "3e5b870e-4c29-4219-86f3-af54a9366e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764631011, "uuid": "35c71e90-429f-48d1-bd9c-692a72c40270", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7265ca88-cebf-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764598210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598210, "uuid": "932de5fa-150a-46ab-971b-b054a904274f", "comment": "Malware payload (DarkTortilla)", "value": "0abb0b3f54389bb5f6de00c38a7f2393", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598210, "uuid": "3dcb73cb-0f22-408e-b4c0-f930f0222534", "comment": "Malware payload (DarkTortilla)", "value": "b02b279161596d4cfb6a031d2354460ab7d4918b0963f24a24560c2014ca9251", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598210, "uuid": "103cb2df-5368-475d-aaaf-047499143970", "comment": "Malware payload (DarkTortilla)", "value": "f4021615d2d7d5c77ea623f3d42ebafe27b8809e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598210, "uuid": "4ed0293a-3323-4648-b387-2e3f0bc9b73f", "comment": "Malware payload (DarkTortilla)", "value": "7f06f997b93dd05a0a8b36087d51acd34f240c4cda976fbce8d47b47e8b70eac3fa0ee9d1b3328f9329e6a040518d094", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598210, "uuid": "ae431709-8095-4611-a8fc-100ce0f34550", "value": "T1A7C4AD5833EAA244E17FA7398E764A0047F0B913CA32C61FF69754ED8B6679445233B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598210, "uuid": "dfe34fea-7465-4d75-9d71-7517079f3361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598210, "uuid": "a958d4fa-4b51-4427-a391-569530365891", "value": "12288:xV1laPZ2hJ650omh69b1zui3KP1QSGbG:EQh2b1HKPdGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598210, "uuid": "9483b75b-ed6a-40a2-8ff2-30913784a7bb", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598210, "uuid": "8d831223-df78-4568-b16c-5f9f5b7d2930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598210, "uuid": "baa4b67b-48f6-4253-825a-d3759c662d3e", "value": "BB_202509...019860002611082025____________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9ab609-cef7-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764622141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622141, "uuid": "f767c430-3d96-4dfc-98ed-669766b9579a", "comment": "Malware payload (Socks5Systemz)", "value": "a3a79b56de319c3d10614deb74289dc1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622141, "uuid": "06a6b9fc-f8f1-46bd-976d-b0f32a6bfebf", "comment": "Malware payload (Socks5Systemz)", "value": "b06903e5f0368fa2c51bbbfdc5783ad893f986757653761c18b688c4bd31a638", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622141, "uuid": "98e217f6-696f-4be7-98f9-550ccf9e38d7", "comment": "Malware payload (Socks5Systemz)", "value": "deaa5b17ac362d372431aad1fc3ba9acee8357c4", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622141, "uuid": "33b548eb-56c2-44cc-b054-e7d0230a343f", "comment": "Malware payload (Socks5Systemz)", "value": "843ffeffed381852469fd3008220fcc88553f29a7318671ff9e18a057efff74239c6a2df55511e3e43acc4e7d0ec03bb", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622141, "uuid": "43402743-a5d6-46b7-a5fb-cfb33d5afe38", "value": "T172F533C254D199B4E360B476A78609A98AB2DB0D7C77E04BF30F0D6A5D7203AEC757E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622141, "uuid": "6abf3fc9-0e19-4e0a-957d-62c62b5b018c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622141, "uuid": "1936f5d8-c07b-4d71-9064-7ef417afa35f", "value": "49152:C9atQF7EduHslpPObQdXtqhNudhdr1VqM2zj8lL6PFx78GeaPUmvSmdJ4OhgEY1e:MaSqdkslp/q7OpXqMetFfanOO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622141, "uuid": "c78878ab-83dc-4591-b78e-22acd2f29409", "value": 3464597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622141, "uuid": "4754f08d-2e42-4660-a7b1-d4941a5b588b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622141, "uuid": "0c0a3ced-a36e-47d0-8a78-9098daa0cc1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae72c2b-ceae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764590923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590923, "uuid": "5adfbf03-dd0c-4869-8c18-d6f7efb8b5c5", "comment": "Malware payload", "value": "674be29ff8c21f4ed8f5840877ecd845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590923, "uuid": "722a9ebe-55ee-44d3-af7c-626880ddf13a", "comment": "Malware payload", "value": "b1890506e1e6400996818db0bbfc1a7dda3108ad078d2c5c05e64a8976996f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590923, "uuid": "4916b0cd-87d2-487f-8412-06f25225fb3b", "comment": "Malware payload", "value": "09b0a0d82fdcb62e0aa77c1d85d5ae64135bb291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764590923, "uuid": "473e9615-b1c7-467f-b280-b55d51abe9b8", "comment": "Malware payload", "value": "b9a9ccbe735040fa6b86b88a222661de79cace48ad972484ba16bf7983bdca79f92d6b627607e5a634c366270af122e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-vixtamp", "colour": "#BD7D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590923, "uuid": "f525100b-5b0f-4698-848b-fc9a39815665", "value": "T1E0F423002DB57F9CDAC88F702D364F151BF79FAAC955E1D329A824C1A5BE304287BE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590923, "uuid": "1baca927-4620-43ff-936d-104b7f4f9ba6", "value": "12288:G3ks4boR4x2jlPJ/SXCvGuLxaZsqsGNhmhWpAUjkkVby+OS+toR4:Hx2j9BSXBuLxaZsDGuURf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764590923, "uuid": "4b692fdb-3800-4300-bc53-979cf36f7e1e", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764590923, "uuid": "15d8f58c-a949-4c3b-94a0-ff2022b9fbe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764590923, "uuid": "8e898b4a-bc94-4298-8260-ae782b9d457c", "value": "load.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170b5120-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621249, "uuid": "8417794a-5930-469f-bde9-b6fb30fefa4d", "comment": "Malware payload", "value": "744392b23d23a9dfa0e5218ff0c18dc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621249, "uuid": "0c9ec8f8-3935-4641-86d4-5b34832d16d0", "comment": "Malware payload", "value": "b19a349cac773606d28a94b5ef5f2708f1799eabca281a5a29e9f32c9a32b929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621249, "uuid": "c66e1be6-02e1-4c04-8825-b26c10f4db28", "comment": "Malware payload", "value": "da9d9fc60f7dc1139cb35d4fc23131bc7d5b76a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621249, "uuid": "57ad0b79-04b8-43dd-89a6-bc3d648869eb", "comment": "Malware payload", "value": "168f58898e7ca3c498342d378936b626c5d29ed2d69e3213732307c28f39d592b15d634c93b4339dafdf1e7b9c31e630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621249, "uuid": "c3cc6ea2-69cf-40f4-9efa-b8e36c205b90", "value": "T13875338E21D51D8F1E2DF0B2025251D6CE1E56BFF0270A8FF82D27D925EE718D531AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621249, "uuid": "9c30ca2a-f475-436d-aac4-c7bc99606f77", "value": "49152:29Efox57RvBBvc61VMes/wE2Luy9wzW8+PmbkB0SMLQ6:2px59vXUmbs4E2KW8sF0hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621249, "uuid": "45bef0d2-a1d8-4b0b-829c-5d6440a47edf", "value": 1674352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621249, "uuid": "9099c71e-9530-4f4e-bdb7-715de328ca03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621249, "uuid": "ca830b63-f615-42f9-85a6-8c3469df6455", "value": "ayame.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8ae7f-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621241, "uuid": "5790a05b-9d32-4e92-aad0-b91a9c62fb95", "comment": "Malware payload", "value": "0f81a6f1767a5ec25eb985e742e59474", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621241, "uuid": "83ec5236-6fb2-4901-aa14-106f3498e28d", "comment": "Malware payload", "value": "b1c3a8818024ee86480bb83ea405ba2d9f96ea279e5cf9df19b3d3cb934ec42d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621241, "uuid": "952a1402-bda0-4c80-8e48-b147b042b8b0", "comment": "Malware payload", "value": "e991fe047582dfa7d20285ca51b698dba7184ace", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621241, "uuid": "bdfbe499-f8f4-4d1c-99a6-176deda5a7bc", "comment": "Malware payload", "value": "209cee3a7de6eb79c6f09f23cd4dc0450686475ac4658db493aec3aa5698bde6f68a975ed7bd48de7adffc30d76d2cfe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621241, "uuid": "a2ce73e6-5b5b-4981-b20b-eb95f83f3148", "value": "T120561282FB58E42AC577C03386B50636625A5D4CCB45E3537ADDB32C9AF7AC44AC4BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621241, "uuid": "bf0797d6-59c6-4479-b8dd-3f58f931efc4", "value": "196608:lbJ1HoTMckDEhdOYNclXTX5/NPwT8xijUv30:l9KtNclXTJuTVUv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621241, "uuid": "bb80b8b6-7071-488d-a2bc-a701fbdc2539", "value": 6463442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621241, "uuid": "f087bc5b-ec00-4668-8885-0da8f81fbe55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621241, "uuid": "9fbabea6-8508-443b-8553-19212cca9755", "value": "Cuanto sabes de Historia.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199a0e8c-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621254, "uuid": "d773db6e-a5fe-4dfb-a97d-52a8c0e7625a", "comment": "Malware payload", "value": "b3d70f5030eca137d696658a68a075ff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621254, "uuid": "3befc10d-d673-407d-a345-e51eacfac768", "comment": "Malware payload", "value": "b282302aa05bcbf31a0f2b1235fa16744cb21f0c2401d20e756dfc31d4472f8a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621254, "uuid": "48b0ad5c-d240-40e9-9ac1-abbfe4033683", "comment": "Malware payload", "value": "a24d460f0b8923f65c9071fa9fcfb2dd186df96f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621254, "uuid": "8a58349b-0685-4c0f-bbdd-6a28ac8b2481", "comment": "Malware payload", "value": "c2b8b5bcbca6da8bed4414100884b9617225acd8645e01dc31d9846b5a9dfacf5e703cb07629b9ed36ee88c8f743c03c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621254, "uuid": "c59a5308-c176-46ec-9a76-73b1e140a291", "value": "T1B5373342FBD4944FFCF793325F32416A55158C6B8B83D28316A1B2BC09BBAD14F46AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621254, "uuid": "736b5b78-009d-45ba-ba41-7e57ceadfe9c", "value": "393216:5u9Wmk2GUxIo3m0iw3CF3xp8Ib+SEBfkvzgFtNT8h2d8R53Y7go1JVYZ9q0uqMKl:t2l3m0KdxptJEBfQgFTCZY7go1XYZ9wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621254, "uuid": "21d310aa-2edb-408d-a9d6-b86ac45f3358", "value": 23345685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621254, "uuid": "0da07774-6592-4d86-8394-f6f28760e642", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621254, "uuid": "484f1037-7caf-4d88-969d-81a6fe9bbca8", "value": "com.jjj.jjj3.d007_20251115_1318.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05b0dfc-ce73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565726, "uuid": "8f670ce0-5803-4d56-8951-84e18a3ac709", "comment": "Malware payload (Mirai)", "value": "abfae51fbea8095650ed03cf983a7576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565726, "uuid": "b64ed5a1-3b06-4c4f-bbcd-1a83fa7f4e0a", "comment": "Malware payload (Mirai)", "value": "b2a9a313364beca9f0c8ca3bfa4309d39b836a0852cf7953ce379353983f28ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565726, "uuid": "cc6f8c4b-0531-45d7-8510-1640c4982d71", "comment": "Malware payload (Mirai)", "value": "b0830d27e2e9aeb39e5651a57915bd9df4743eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565726, "uuid": "a4c2d44a-cdf4-457a-926f-bfae3e14ad34", "comment": "Malware payload (Mirai)", "value": "92d3f8343bd66a914ee71532ffb86401c63d6f102f4ec3d9554c40f92396808f0707d50346f494047b2ebabbe3f7726e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565726, "uuid": "dceaea8f-8da8-4173-b62e-8e2374e7c614", "value": "T12833F1A8ADE157D7CB3DCC3BA4CA17B77900B0E422AD9580532508CBBE780BAD946471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565726, "uuid": "46a25ff0-37cb-4665-b240-c379b10e42b2", "value": "768:UVPEFUoG3LZ3abs+FIjN05WNDVVpjt5LL3MhQf3O6M6vu6whWu:kPEoZ3abs+Spoqt5fchW3FHw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565726, "uuid": "f3a8d552-e7f7-4518-9e41-e23bedb6657e", "value": 50520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565726, "uuid": "29d15dd4-088d-4829-88fe-cd3c49b87804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565726, "uuid": "6f455bb5-39b2-425b-a5e7-a6b6559bd8fb", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d16924-ceb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764592526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592526, "uuid": "1dcd5d2f-4fba-4f08-8d6f-1e1c35bca7df", "comment": "Malware payload (Mirai)", "value": "97a63cbea57371358512b37262f43f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592526, "uuid": "3072406c-2843-44bb-8a38-b5904ebaed69", "comment": "Malware payload (Mirai)", "value": "b3d678865abbab8c545ae7947f738e764a0a0c078a4bb268894137c6af0f4ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592526, "uuid": "5fed1085-a25f-4a2d-8603-3a36561a0f0b", "comment": "Malware payload (Mirai)", "value": "afe129f3cc2f5f530e915e341443909e865acbac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592526, "uuid": "0b693a3c-3d73-4fb3-8b91-72aa9fd90fb8", "comment": "Malware payload (Mirai)", "value": "de2c80c3e23fa626c0bbfc99e1854e1e95fa42f5f3dcae51e4d60770a9996ee612d7c4f25e26c0ebfd4b0cca276259c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592526, "uuid": "6c1d753d-9206-49dd-abb1-03b52e15cd40", "value": "T1F1B3494273180F57C19749B02E3F17F687BEE5E121E0BA89650EDB5A8275E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592526, "uuid": "4301034e-2dbc-4c51-8c06-8623eb0626b3", "value": "1536:gHXylSpMEscMYse9k1ci8pRbKLvYnAXVKDY9r+JuUqtBxHV/tE:8Xygpusk1f+blW9+uVTtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764592526, "uuid": "d4cea0ce-bd88-4359-a3a3-f2c2db10deec", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764592526, "uuid": "3700a178-86c5-420d-8d59-cb19e09db16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592526, "uuid": "4bb090d8-0303-4eec-89b8-c95df07b8ea4", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859141ab-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578055, "uuid": "889c4eff-ec11-4a36-86f6-944ef1822855", "comment": "Malware payload", "value": "7a8988640beb7cad7818b8ed254169de", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578055, "uuid": "05135355-9de6-4794-8d1b-60197da91954", "comment": "Malware payload", "value": "b58e9774417890cc6e76d1fee77292d990bba0ceab88abd6d5929b66c44c9cce", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578055, "uuid": "019b5380-a331-46a5-866e-e02b1f09a6e2", "comment": "Malware payload", "value": "16571ca9fcc791dc0116aa8faffac6ce9b9b411d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578055, "uuid": "62bc7bbe-7c74-468b-91bf-b09d9d8ddd2c", "comment": "Malware payload", "value": "72b79540ab813f41c8b3eaa32f59667da1617cac79d45bcbcab6a3e137442ca693d9b8d5407eb834c33cebaf64894ffe", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578055, "uuid": "324c0134-afdb-4cd5-94ba-842b3198033c", "value": "T1E56533F568329171CF24C865EE8F10190DE2291F0F46AFB139BD42D5601A79FD8AD8BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578055, "uuid": "774e8eac-f5ca-43a8-9ce6-cd4304306642", "value": "24576:32d9GUqsdu4kk0SpX2e/6BOxGFQv09cOVUmIj6uGKtJiIv+uUy0lWc5+M4YBHMOj:A9GUvjkktXv/6wECv0jijoKmpu50lWmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578055, "uuid": "ee2a9dbc-dd09-4cd0-a20e-bcf6c8d0a245", "value": 1473260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578055, "uuid": "4ed0dfcd-6798-46b7-9efe-317bf73b5023", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578055, "uuid": "7d5caed2-28ec-499b-8d29-18885a0edc1b", "value": "setupMP.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0543c68-cea2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585858, "uuid": "b14a2ab2-dc81-4e5e-a100-0704a20fdedb", "comment": "Malware payload (Mirai)", "value": "97b5b5dda6192ab56b2bd435707fc5eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585858, "uuid": "0e458175-6aa2-4b9b-b7fe-c7cdedd85f96", "comment": "Malware payload (Mirai)", "value": "b5ad80ac7cba318becb4dec3b9b8ed907de90a28788a8b32cc925eed7ca5f17b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585858, "uuid": "bf7f1da6-504c-47bd-9032-e9195c3df2f4", "comment": "Malware payload (Mirai)", "value": "38cfe70f19ae00dab5491dedd4489dde701e08e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585858, "uuid": "d730ea55-cd28-45ee-ae7b-a757942037f1", "comment": "Malware payload (Mirai)", "value": "3a4750b50f90541c727b5bd10cc98338e786d8f12dc60fb317ed5ce66c49819d9cbb17a72bf302539a27af08288ab558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585858, "uuid": "f8c56f91-da18-4820-b037-3f6b052d3246", "value": "T11963013272573CBA1B70523BBD5C8B66FC9FC2B8E06F71258625C93C24DD9834663989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585858, "uuid": "d9e32dd3-c087-4284-aaea-084f8dfb3345", "value": "1536:1YWnPpMi9HTxkQZ5iIdQnsfkidwAAK2LJ6qxXXDvNdI9AEqRVz:1YWBMUTcI+sM9AYLJ6qxxdI9AJVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585858, "uuid": "e95a1975-e409-49c6-9b87-e9840045e44e", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585858, "uuid": "c15dc8ef-4634-4c63-8cbc-5d34398beebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585858, "uuid": "2587d1d0-4263-4486-9750-63fede8e8b2a", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924aa82d-ce71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764564762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564762, "uuid": "a2a3aa5c-ca98-4543-b579-5fecdf813ffe", "comment": "Malware payload (Mirai)", "value": "1bc0917eb72a9a95a9219b331a45e9be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564762, "uuid": "0d45bcb9-b48f-483a-85aa-36d47491dc39", "comment": "Malware payload (Mirai)", "value": "b7fa748325fc32394164fdce01e2d903da6678589ef907b39f76467a44f1007c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564762, "uuid": "82d9700b-a2f8-46cf-839a-ba6f8ba47dff", "comment": "Malware payload (Mirai)", "value": "99d20bca161ae2f31c734263d4641aa687e58ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564762, "uuid": "1d37162b-0ab5-4398-8255-a31b589ac8ed", "comment": "Malware payload (Mirai)", "value": "8d29b71915b3e03d362b481cfc8e8fe9269e0cb5e160012e154af8afdcf607ff342e0f3adaeea22166f00475f2a9d4b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564762, "uuid": "e16aed89-5749-404d-971a-67a5fc495870", "value": "T18923F1D7EA9AD17DC077AAFF1149A1E0F9302C97851B2E3B658F337F446AD101624A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564762, "uuid": "d6ffc8dc-79f8-48b2-ba13-d1a7b6335c47", "value": "768:ttB548w628WWpbLcWgmvRV3CFRnuRRtdLYvp2nDd1JFNCUkDKcQde+GMclx058:PBw62YcWJVOuRR2mDvJzcA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764564762, "uuid": "6fbfdd6f-8950-4f3c-a055-ad54ffa9b13c", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764564762, "uuid": "c3c4a32b-204c-4841-a48a-c3720dcfe122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564762, "uuid": "8d46c793-f47b-493f-9d3e-af5028a40a57", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220f6abf-cef6-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621697, "uuid": "1b8fa598-94fe-4fc5-bd13-cb1fc3c07760", "comment": "Malware payload (Gafgyt)", "value": "fc091dcd670512338ef4c8438bfdad4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621697, "uuid": "7e9b456d-bf97-48ab-aa6d-4e9183f4f152", "comment": "Malware payload (Gafgyt)", "value": "b84a54d3f1b1e459d4eb0414d5d8305053c54a1b0bd6501c146d73a34b4bfe2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621697, "uuid": "2cfdd2bd-32cc-4b32-9909-a0ce5b7fe14e", "comment": "Malware payload (Gafgyt)", "value": "7a75256f45dda15bba33f9c79beb728c321f825a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621697, "uuid": "01c96ee6-35e0-460b-a14f-e109100fffc3", "comment": "Malware payload (Gafgyt)", "value": "ad882cba05fcb6aa685b0585b05746afc0b0f41254af400007f46130d127d35211e7e82054a25f960903b3701e2b45ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621697, "uuid": "59df9709-744c-4138-8737-99e1ba48a4de", "value": "T1BCD34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621697, "uuid": "e2077c6b-b74f-4384-bcce-984a3087f676", "value": "3072:B1E8x83QHjqmgjHmhQXnd5hZttT5I7mAK0qW6MyoQ6:/E8q3QeXrHXnd5hZvT5SmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621697, "uuid": "28c5e969-dbea-41f9-8bcb-7af3b9d5f30c", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621697, "uuid": "1431d0bd-3e2c-44d8-b620-f4e636b35b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621697, "uuid": "c14c9fc1-6704-4044-8cbb-7c445c537cbd", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b77560-ce5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764556962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556962, "uuid": "12d0eeca-166c-4e47-8a0f-1974b1c2c7f7", "comment": "Malware payload", "value": "b23908a49fc9d2f016247ef4bd6f883a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556962, "uuid": "6a9eabb6-c61d-47a9-a286-85cc9a8805a6", "comment": "Malware payload", "value": "b890baa7a7da78f4c4e5df2bfcdf81a11e5acbd540c65f1a8a57b53c7cc22b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556962, "uuid": "82205794-3220-451f-81aa-34e2b7fe1f05", "comment": "Malware payload", "value": "441fda9a611a3c2f1f7a6dad1c1b6aa37dbeeceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556962, "uuid": "55ae8681-d6b6-434f-9db9-b97272239ffd", "comment": "Malware payload", "value": "d3d219ed99e3cb4a5701d95a9ab90fc3fa7874574b756fd7e591f8fd355035cfde831372d74bbba7aa6d1e62df5e39ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556962, "uuid": "c1a371be-1dc7-4f82-87d4-9ff0a8c1b5ff", "value": "T1099302778978B3E9DAA1E4F0964C278D041653C8DA46BB61370E78654B083DF0D9F39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556962, "uuid": "5465cdec-c6c8-49c7-bb5a-3d48446b2ba7", "value": "1536:2nx7pSTlZ3FtM/KFz+EhPVyw77e6tZ9TErGwHQsTKfj0WY2gf7mL+6luGd:2glZ3FtCKXhkmHtZ9TEKzjfj/WMng0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764556962, "uuid": "741cb933-2b1b-4fdb-867c-0d2326f29f7d", "value": 88832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764556962, "uuid": "7c95b0a3-cddb-4eaf-9121-d96714c3a131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556962, "uuid": "41afd14c-6241-4131-b42d-99a70f6e5d36", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83f30fd-ce71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764564799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564799, "uuid": "ce3019d7-a31f-4724-94ae-51e46e31c2ce", "comment": "Malware payload (Mirai)", "value": "3d64bfa652d824c02f500bcdc6313a04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564799, "uuid": "45ce3b6d-93a2-4335-85cc-b396723bc19c", "comment": "Malware payload (Mirai)", "value": "b94019781f602f9ade7fad8ee0a2b290410fda0ffccc97fa375cd4e7f0600f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564799, "uuid": "2a50e7f1-c506-4135-b582-6fec13a660aa", "comment": "Malware payload (Mirai)", "value": "76d8e4982a1c18385b531ad28a1cd60568fdf790", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564799, "uuid": "2b441c6f-8903-44e8-81ff-9ddf7eeb7e6d", "comment": "Malware payload (Mirai)", "value": "eb05858e352f8db8e6a8f6c5e92fcb2252a26d85b394179e7bf6fb56c280936c2760c9090ca76b85aa236c008db95427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564799, "uuid": "5925480d-e085-4a65-aea7-c2e7ce571974", "value": "T129B34B03B8C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE600B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564799, "uuid": "6a7382bd-36db-4744-b91b-400a4f8f737a", "value": "3072:emvsrP1O2m3v9yg62bUQ5IuGcLlumTThDygfEKEpMC:emvsgv9yg62bUQqTYTpfZWMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764564799, "uuid": "68bb3fbc-9bca-461b-9c78-3262be920b57", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764564799, "uuid": "dec401d4-7f39-49b3-8e4a-56095ecc70af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564799, "uuid": "27a8eeae-9059-404f-b728-d08b5babbe34", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f2af86-cf07-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764628970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628970, "uuid": "be1d7d2a-286d-4f70-983f-530d86097d63", "comment": "Malware payload (Mirai)", "value": "b1dc4084d3c8b74fb0518123344dfb7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628970, "uuid": "6d9bc01d-d902-48cf-b11e-ddc826ababe2", "comment": "Malware payload (Mirai)", "value": "b989854729d2716301e63497342ea40a12a2ed1c0fa3e839397a7d39fac60fd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628970, "uuid": "3b1a6a23-4f6c-46e5-a23a-66e0715043a7", "comment": "Malware payload (Mirai)", "value": "ea9f1b87b06f60dd49f6b99c4fa53d79a6e41bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628970, "uuid": "d8dc396e-0efa-4c9c-9caf-ef38d2a57242", "comment": "Malware payload (Mirai)", "value": "15acd93b6b60131444d79fc805100c49ad561b0f5554153e3f667023d0788c1165d09b21d6991363ec12c99a5af619e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628970, "uuid": "322f0d97-4a44-4b5d-b014-b3f29d987b67", "value": "T1425308917CC29A2BC6E423BAF5AE518D332463E8D1DB322BCC516B1477C551F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628970, "uuid": "560d1522-186b-4218-92d4-fc0213860ae0", "value": "1536:8w3f3zMcNmPwQfbBzNV2T+BzcGILX8ngj2iod+SPucOb+/s7FUoh+gjryeZ:vP3zMcNmPwQDcjMtNk7FNhLjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628970, "uuid": "2ef71bc9-65e0-41bf-b66a-33e8bd989355", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628970, "uuid": "e935d530-4e01-4e8f-9f91-f2440f08a0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628970, "uuid": "5d15294c-822b-4836-9807-fe7223a53716", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9e4459-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584132, "uuid": "3f109fea-d484-4d63-8939-4256cc8a2079", "comment": "Malware payload (Mirai)", "value": "8b4cad2fb20d0cdd274c28a0491f309b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584132, "uuid": "01537d40-3c8a-46ce-9307-7c6a321e99e6", "comment": "Malware payload (Mirai)", "value": "b9f72dc346f0130789dd6fc9cc4545a9c7379dee66c9a6be2174800b23ac5d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584132, "uuid": "3e15f3ee-5828-495c-a8d7-90ebc2292012", "comment": "Malware payload (Mirai)", "value": "87e8f8965dfa949a9ed23d0de6d20f2a4d234889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584132, "uuid": "60b33f21-6695-4725-a15b-8fafb1c87be4", "comment": "Malware payload (Mirai)", "value": "68bc20fbcb4370e2bca538347bfb1e5d240416f394ddaf8d4ca5ca8c994ec28391c4d957e11d847ac925bac49c603d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584132, "uuid": "70d44bb2-85d5-4997-8690-96690962aaad", "value": "T1BE146A16FB0C0463CA931CF04E3F4BF9A3621A9104F99515650C7F5A2A76D37A28BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584132, "uuid": "68cb31e3-b1be-4b43-a46a-a11807416afe", "value": "3072:Emh0VJhVGtf0gRpFtAsKGQn0ZyA+Py8hF2sQ0buAvLFE+/kwvTGRUam:VhOg0bGQ0kHPfhF2CrMwrXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584132, "uuid": "f1798144-7803-4da0-91aa-ce2f772a9f0a", "value": 197320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584132, "uuid": "28272ace-9470-4c11-af56-890bead00673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584132, "uuid": "d86bc8c6-a820-4d95-89c7-23d8791de82c", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716024cb-ce4c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764548816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548816, "uuid": "ee9dd644-8a9b-47c4-bd27-2c24ade20354", "comment": "Malware payload", "value": "d50334f3f4d548e45f43c219cd512be6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548816, "uuid": "a0b030ed-cb56-4601-92c0-d09eb5f07187", "comment": "Malware payload", "value": "ba30fa8b6112ffc876a572c2485a7b087780d601884a02c578946adb25fecab7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548816, "uuid": "608cb03a-750b-4f43-a479-83c7cd7ac9c3", "comment": "Malware payload", "value": "7a6d34a592363f6e4731924f6ef3486639c9b62f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764548816, "uuid": "6517aebb-976f-495b-b91c-8b05adb9a5fe", "comment": "Malware payload", "value": "59d3ff9dff06e9cc59be56774055aea5f5f4bc498d715a478fe13f88c61401047fafa1356eb28a2e2742c2b04c37c08d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548816, "uuid": "9880d4ad-ba3e-478e-a2bb-a781c377d1fc", "value": "T1417366885ACFC4E8E957745849DFCC01EBEE98070A1DD999FA4CB5D46F01C28A1FCAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548816, "uuid": "659d758d-22fc-4ad3-852a-5b88153a8652", "value": "768:7fTkrDFPAQBArBUqcDnYRA4suwmelNmIuocZ/4e/OGe1wQVsMfGtGWjopNA0Vv2g:MhApA9tlNGoHNA0Vv2sG+gf8WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764548816, "uuid": "b3f35b9f-26d5-4013-a901-03230ce2be43", "value": 76453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764548816, "uuid": "9df98134-680a-4abe-a4e0-d1b5d1e0e2e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764548816, "uuid": "4703530f-0f07-4bb7-8d3e-b57bf5423dc2", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7a2bfd-cee5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764614767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614767, "uuid": "65deb7a0-2f4a-4f1e-ad30-c89abb7e2cad", "comment": "Malware payload", "value": "64b14bace4f5287c359493c875449569", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker.Win32.ClipBanker", "colour": "#39FDD9", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.WinGo.Agent", "colour": "#A83338", "exportable": true, "hide_tag": false }, { "name": "Win64.Trojan.Kepavll", "colour": "#3F7707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614767, "uuid": "ef0efd43-db59-49f5-ae79-2bbb1c15e992", "comment": "Malware payload", "value": "bc29522ab9edfc8018a9771342d014e2028ed8485113f3f548f4706e6d1e567b", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker.Win32.ClipBanker", "colour": "#39FDD9", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.WinGo.Agent", "colour": "#A83338", "exportable": true, "hide_tag": false }, { "name": "Win64.Trojan.Kepavll", "colour": "#3F7707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614767, "uuid": "f5211ebb-6464-4281-b8b8-6c69e8e37c89", "comment": "Malware payload", "value": "75e80d24ad0f595c1c794f810eb9ed284b122767", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker.Win32.ClipBanker", "colour": "#39FDD9", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.WinGo.Agent", "colour": "#A83338", "exportable": true, "hide_tag": false }, { "name": "Win64.Trojan.Kepavll", "colour": "#3F7707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614767, "uuid": "45298c26-66fe-4d10-bd7b-a68609f9a7a1", "comment": "Malware payload", "value": "878f28131bd85ccbdfa31229203efae09102325c98991d988002756e2dca90191ce5bd289395e56622019a621ed4212e", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Banker.Win32.ClipBanker", "colour": "#39FDD9", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.WinGo.Agent", "colour": "#A83338", "exportable": true, "hide_tag": false }, { "name": "Win64.Trojan.Kepavll", "colour": "#3F7707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614767, "uuid": "aef70324-7382-47ae-86d5-70fcb813a549", "value": "T1D7B69E47FCA22DE4C4E98230D12B825ABAB17C591B7923DB1AE0B3781F327D05E76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614767, "uuid": "be09e4df-ae66-4f74-b411-fe8275bc5dbb", "value": "5201b5460da476f5ca537a2824ed8680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614767, "uuid": "6cf53fd2-667e-4d60-8bcf-3465a69bf680", "value": "98304:GRXtISHJdgAzHA1EZHIhCGs6qeTi4c8m83wLdMNCYzrfa/dEB0+ELlZX:GQEdfHA1EVwTChZEhLaMalR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764614767, "uuid": "79b35d1a-39fc-4646-bb70-b69707c7d270", "value": 10810928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764614767, "uuid": "42d771e2-abb7-4b5e-adf7-1b075b432fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614767, "uuid": "9e1cfcc7-55fc-4b54-8528-5318bd5b7a26", "value": "spooIsv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6731cab8-cea9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588742, "uuid": "e61082a6-396d-4191-b4f6-d5a164f4380e", "comment": "Malware payload (Mirai)", "value": "d993f6cae6c22526a01210072c231177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588742, "uuid": "ccd3981d-54f0-4208-a9d5-d8a9e895dccd", "comment": "Malware payload (Mirai)", "value": "bc9d17e877304acb3e28fa9fbb68705ed2a55e7cf4ced4e362e7d632d9969641", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588742, "uuid": "b9c554da-ae21-463b-8fbf-e75f2703cac1", "comment": "Malware payload (Mirai)", "value": "5c4328081dd9b9ca24683e81d8e829ffbe8375ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588742, "uuid": "ef51cac2-0a4b-4492-a359-18738d026d70", "comment": "Malware payload (Mirai)", "value": "42513d24561a38ec1afc10ba6508200b20216bd235bc00b2a3dc1d4c24416ae10ec0d3febdadab5eeb11dbc2d56007dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588742, "uuid": "3b5fe8df-22f0-44d0-aa3d-d7a2295bd7b1", "value": "T12AB329C0F98B81F6C40B8C306166F63FDE31D9A95171CAADEF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588742, "uuid": "77250e06-4fdf-4914-bb2c-7a58c699878d", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJLTMUfnDHGKgpuzFlo1Okm:q/ij6i8CsMTMXX9KcQ8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588742, "uuid": "8f5b6458-593b-4414-9977-404b73de5c4c", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588742, "uuid": "8e71d7f4-18f7-4c29-b175-a1f8afef54d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588742, "uuid": "f712d3f5-7a20-4230-ad91-caa4bf2a5c4a", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a4e120-ced8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608758, "uuid": "aee55b4c-6c17-4097-8c83-93b1378a8e97", "comment": "Malware payload (Mirai)", "value": "e6f0f8ddfbb748b8e34650444c2700f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608758, "uuid": "d53651b0-0cb7-4ea3-951d-1f8aa62613ff", "comment": "Malware payload (Mirai)", "value": "bd0634fdf19c049472e92b85bf78b3d31bdb65a17bc0c927db8731e61a32d7d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608758, "uuid": "4cd16f04-818a-453f-afab-aede2726f927", "comment": "Malware payload (Mirai)", "value": "a5f3039c70c296961b77fce5e3ddb7d40e654a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608758, "uuid": "a7ec72ba-d463-4c1a-b30e-d9abcafed87c", "comment": "Malware payload (Mirai)", "value": "5dd4ab0742d245b60c3e6af162a4af2023b020bc307b31ebefbc9a3425db29ca4b56fb2bcf9febd99a0faa82ef610174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608758, "uuid": "43f936dd-37b7-4d4d-a731-43fc2f897822", "value": "T12C330984BC91AA17CAC15677FB0E83C97B166398E2DD3303DD26AF61378B92B0D67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608758, "uuid": "58b852c0-1bfd-4f89-ada2-e26072496abe", "value": "768:F2NAebA6wnFB+IV09iUsHPv4megdMxCCkGyGojmB0buB12oJwE8z0I:ANAEUzVPBvvVMxCPgYmO6BkC8z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608758, "uuid": "912579d3-ed26-4889-9d3a-2655785f8e7c", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608758, "uuid": "32478954-f1a6-489b-bea3-5e3d3a671bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608758, "uuid": "ec52b91e-2aa5-41c7-8af8-a2ca2baf073b", "value": "niggah.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f18c6c3-cec3-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764599976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599976, "uuid": "8d2e0917-8b39-4fc4-8255-cb852b2cb7a3", "comment": "Malware payload (GuLoader)", "value": "66f893c25af98f5ba3874b839da4fed1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599976, "uuid": "77067c88-fd25-4f9f-ac5c-d7c2d28ea588", "comment": "Malware payload (GuLoader)", "value": "be28a1305cd49e4ebbbe10d3be4d70d2c44f5320a123ed18b6ca7ac10f7f8b72", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599976, "uuid": "acb460e1-8065-43b0-9e1f-b48bd1cd870d", "comment": "Malware payload (GuLoader)", "value": "fdd692a016fd7e0ff9aa4124cda7292ca5362ff9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764599976, "uuid": "fd3f5cce-b66e-4b6f-ac4b-a301c3adc7bd", "comment": "Malware payload (GuLoader)", "value": "15e9219f3cdeba5976d279fe123390797cdb676ca740884d2897304129cc8074f8e948edfd49977f0789674ca9f9a355", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599976, "uuid": "5f2d59cb-4c82-485f-834b-82186c5db72b", "value": "T1D6155B60DD2407EA4F8B17DD7C950A82C9BDC20A551754F2F6C90B8E72068DCE3BE6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599976, "uuid": "6c62edbb-5f45-4769-a3a1-f51879c983f9", "value": "6144:80r40rZ0r/x0r/A0rI0r40rH0ru0r/w0r/B0r/gsV0rj0M0D0rN0r/0r70rC0r/Y:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764599976, "uuid": "ec874d83-4a83-4b70-a254-6ab8509d17c5", "value": 886143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764599976, "uuid": "5a24b36b-f7e0-409f-9a8e-ad4eb8309ee4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764599976, "uuid": "c7ecdf0f-a8f4-4628-8bcd-17c855bfeed6", "value": "Beschaffungsvalidierung erforderlich \u2013 Bestellnummer 903097802.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b52df0-ce79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568258, "uuid": "80f22883-7232-405b-ad46-07499cef9ae6", "comment": "Malware payload (Mirai)", "value": "0f788c81566fe0e026a4a59ea56ca9cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568258, "uuid": "c2b74923-7a0b-4817-9f71-3863b562aaf5", "comment": "Malware payload (Mirai)", "value": "be4f6da61c5d87754cb77e7009688ce6cdd75ac2e9e36f33b69d28372513f05a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568258, "uuid": "8d33c712-04d3-4f66-a1b4-ddf041eee359", "comment": "Malware payload (Mirai)", "value": "accb5931d7b23592e2c5b6cbc21ac50934df9802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568258, "uuid": "46d9ae5d-aeab-4371-bb39-526a801e0ea1", "comment": "Malware payload (Mirai)", "value": "08f3704c761d2b3b3d98a2e12a4b69babdfaa5483532d69e2fc46ff6d252ea3b765917744bf67b974c49aec702518cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568258, "uuid": "af8255b4-e683-4051-9e29-fceb7de0d5d8", "value": "T1F4343B45EA418A23C4D117BAF5AF424A3332A795D3DF730699286FB43B8379F0D67A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568258, "uuid": "1cac53f7-6e94-4391-b254-42d90ec2b346", "value": "6144:nrJixFzzAzaZKacEK1dAnJdXy9fUabM/97AU:nFuFXAzaZKacE62J8to/dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568258, "uuid": "97b6ea52-20cb-4bf2-bd45-f15c3b327247", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568258, "uuid": "ac6bf312-efd1-4db4-a9a7-d193546dd8dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568258, "uuid": "25cd0544-a9d8-438e-949b-aa25d4a4a6b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbcc5ba-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764578068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578068, "uuid": "e62bece7-644a-488e-86b7-348b7a58eb40", "comment": "Malware payload", "value": "1342db7492197ece7f3116ff4cdf4620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578068, "uuid": "cd8f7e42-4a7e-44b0-818d-9a907829ba37", "comment": "Malware payload", "value": "c072018f06790e10b47feb122498bb5714b3c537f83356b53ab6843ab48c13e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578068, "uuid": "6475b85e-e8c9-44aa-b08b-185c1648cfc3", "comment": "Malware payload", "value": "682fb1cd1acb3cc0842da27bd4494e1c4c0d8de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764578068, "uuid": "b95b3dd6-94ba-411a-b6cd-b7c4a283aa20", "comment": "Malware payload", "value": "e819b219c28be66e28e8a34942f4d3efb20528049f4de6b1fee94a5b2d220ce09beb6b6f9ae165d90117e64047065648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578068, "uuid": "1f92a11d-a93a-4607-9470-d78691a350a2", "value": "T1BA469D22FDC9A872C8900575CE1B81FD5510AC207E6D35173EDE7E0EEA7E790361A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578068, "uuid": "1c0da6fc-3b18-4b12-99b6-1955766132f0", "value": "153e61bd81684895c7ae4081204e6cf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578068, "uuid": "e6d1dacf-0375-41ae-9ceb-c53cb95b5408", "value": "49152:mv1eFDEJIjQkVKkC4n+frBWIEYd7EehC:mv16oajQkVKkX+fNW4dlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764578068, "uuid": "d86ac99c-77bf-4d1a-9d0b-02eeeb24b21c", "value": 5408768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764578068, "uuid": "e1aa7ae1-8a77-4aeb-8741-a60b377961c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764578068, "uuid": "7c918d5b-0c89-4767-ab74-17ec46bd9073", "value": "setupMP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bb276f-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621292, "uuid": "42b35ea2-b4f0-45ce-9e38-3ce2f66c15ea", "comment": "Malware payload", "value": "ed7769f03f36dfe0ffd4ad27df90746a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621292, "uuid": "02714c3a-f104-4b41-938a-add917b8ec57", "comment": "Malware payload", "value": "c12fbf5b9b42b810a1eb9649e4f9b71dd320967fd8f34ca86ca8bae447deef32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621292, "uuid": "517bf304-bbbf-41c5-8d60-4a8166b241a8", "comment": "Malware payload", "value": "06bf373171a58d9e05ba879eae2a26cc690854ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621292, "uuid": "7cbda4e1-1e30-437f-bcbc-a7f10e3b5d1a", "comment": "Malware payload", "value": "df9c7413fcaf0f567050664376b08d7fdbf727093910edb8b0f77f950ba166e33ef27426ab90ef5f2a848a6fa76995c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621292, "uuid": "2b7c12fa-2ecf-4db1-be30-3c1f2e838ef8", "value": "T155753359BD13EF4F56F22EEAD70559CF4FE6BB11A00756D40AAFC04B1B12B0A6B120C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621292, "uuid": "eb7dea28-8cb2-4d92-a960-dc08389be358", "value": "49152:PoCxn9hrsO7KiWnC2/taDwRDRZlnEMxX6UkGL0f:PoC59eOWiaCZwZPlnEMxqNA0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621292, "uuid": "856d2664-a728-485c-b9ee-0d8cbed0936f", "value": 1688212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621292, "uuid": "7090e355-35a8-4394-96ab-66d8656341a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621292, "uuid": "cadd7d19-e5da-4830-922d-f32a61a0c5b3", "value": "pekora.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41147996-ce77-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764567203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567203, "uuid": "4b102dbc-5102-4f0b-9e7a-4a235bf3e0ef", "comment": "Malware payload (Mirai)", "value": "859136d7ba91de0c52f65f097a8a1bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567203, "uuid": "73153f2c-c1f8-4482-b79d-9f5d83c83c26", "comment": "Malware payload (Mirai)", "value": "c16050d0c82a7c557bd25e8eccb36dbaee0cb6b1194eb57189a889c8daf3b524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567203, "uuid": "c4d5c652-7b08-4a14-9f61-900ba5abce51", "comment": "Malware payload (Mirai)", "value": "5321b68ab60226bbaf9c21f1aab4b14e4a054592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764567203, "uuid": "a9bb1c45-2e33-42b9-adb4-19462a67d3be", "comment": "Malware payload (Mirai)", "value": "11ca70ea3fe55d601482b77b2f14b8e0f00242dfd6e2b84aa0f1fca9ebad18e201912fab74596f65fad9476ed77b3b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567203, "uuid": "980c2dd5-ad5b-408d-ba4b-9aa648847267", "value": "T1E5B3394273180F57C19709B02E3F17F687BEE5E121E0BA89650EDB5A8675E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567203, "uuid": "3a809592-d4a4-4ad1-940b-d09cc9bbbfe3", "value": "1536:gHXylSpMEscMYse9k1ai8pRbKLvYnAXVKDY9r+JuUqtBxHV/TE:8Xygpusk1J+blW9+uVTTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764567203, "uuid": "20013ae9-5e49-4eea-a19c-a2b71bdac0bb", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764567203, "uuid": "9da5602a-fc1a-44a9-baf5-512134fa915b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764567203, "uuid": "3941cb62-dae8-478e-98b6-bdf256b334b5", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf6c5c0-ce7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764568726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568726, "uuid": "e1242749-16b9-4ccf-923b-aab3ac75f1cc", "comment": "Malware payload (Mirai)", "value": "7ca9479fc8d9cd6e7d9bf29e4a181dc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568726, "uuid": "d3d4098d-d152-4993-ba2f-f27d8f0275f8", "comment": "Malware payload (Mirai)", "value": "c2470797b9c867537251cec363796d1776eb1d3a65460e45ac00eae2a64fed17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568726, "uuid": "943da7dc-b8b3-42bf-8298-52e6631d5c06", "comment": "Malware payload (Mirai)", "value": "ceb5b92543689b750c693a3610d4fd303d002d6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764568726, "uuid": "56225d94-79a4-46d8-ab99-e4b015baef6e", "comment": "Malware payload (Mirai)", "value": "edcc02b8c314a11f13205c863ed584943c0d8081838cdafb8d1d1c5b681f23007018c6972bafaf02b9a8a19f60402146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568726, "uuid": "7c26a04d-ebeb-4ef8-b39b-c020c3529ff5", "value": "T130D3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568726, "uuid": "2cb33217-195d-4e75-b47e-a856a088698b", "value": "3072:20H21ZnmrUjUGcF9n4FN7njJL3sdugpgy+Dq:2f1ZmgZ64Ftnj6kDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764568726, "uuid": "dba9b9d1-c374-4e56-8769-0c47804af3ca", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764568726, "uuid": "8a0ae75e-87f7-49aa-9117-2d9ca0214278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764568726, "uuid": "eff4a985-362e-4cd6-ab22-039926808594", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10455e4d-cebc-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764596757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596757, "uuid": "dee382ca-7ed4-44a1-b020-3dff4354ff1f", "comment": "Malware payload (CoinMiner)", "value": "52577f41fecfb73c299d19ec2d62680e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596757, "uuid": "bfdbc512-ab7f-45d8-8a28-1f9c68cc9cc3", "comment": "Malware payload (CoinMiner)", "value": "c28c65b7f30c1ed7af879a7aa2b6aa8b1f8e54775ed847d0655a8d7bb2f939c7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596757, "uuid": "d46bb5e6-ac46-4be7-814a-70360e3b2255", "comment": "Malware payload (CoinMiner)", "value": "baf4b4596fc8743b273e829e9b68a4913320d190", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596757, "uuid": "abf2ff15-9529-46ca-9714-f1217a7fca99", "comment": "Malware payload (CoinMiner)", "value": "c4e0a9179e06aca853a397fc93ec4d42c48dd0b84895a74dc17b8ed1acd233ab93ae7f83d97f45cce15a85e7b0d4ffbb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596757, "uuid": "68fab068-7736-4668-a605-6478916df294", "value": "T10BE53384FF0100E0C699E93A392EBFB5EAD775768702B3C755469AB234F16C04776E84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596757, "uuid": "2925ca32-eb8d-47ca-ad36-16eeed05b556", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596757, "uuid": "fac8e9c3-6419-4060-b9df-a1e5d1a92b80", "value": "49152:5nL9UCx5OzO00z+iVhiwKQswW3o4ygoirqmdl7SU5408gPjC:R75kO7CiJsbouxrqql7zx8gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764596757, "uuid": "e3676a47-9f3b-42f1-b197-d969975b33e5", "value": 3212600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764596757, "uuid": "8cca7e9b-d053-4cb6-8794-3392522fc5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596757, "uuid": "2c9e6e5c-f459-4297-aed2-513090eec7c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3269dd9-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608707, "uuid": "c89dc373-c9e0-469c-9551-dd670daa91b0", "comment": "Malware payload (Mirai)", "value": "d9375ac7db930e5737f1a020f64631c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608707, "uuid": "9f6ff77a-6146-4a95-b46d-bec8d8edda44", "comment": "Malware payload (Mirai)", "value": "c2c61d4a983e8195f5e346efc23cc797eebf5e74f166b344b93e2ef64f421b0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608707, "uuid": "3de1d37d-30af-447a-83f8-c62b7bdca9bd", "comment": "Malware payload (Mirai)", "value": "15cb6768d51d472ce3724c357e414c5e9709b593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608707, "uuid": "28fe8056-dd16-4271-b923-3f2298542699", "comment": "Malware payload (Mirai)", "value": "c121016258b5d2dd3958fcad50e4f554fc1540fef23901bb178f53b665da0c8d0dcc873adc2537b1d2e0051ab0a9a4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608707, "uuid": "33061e2c-5387-48fc-9015-c453bf392f58", "value": "T1C8B2E1FAB61CFD87D401A1B853BF44A484730F01852F66052DC2E9D7EAA21BD5E6CE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608707, "uuid": "825086a3-8b53-4a23-9a67-45353493909d", "value": "384:MgDWWyJbcFrPA9SoxzdZSvy/cO96mejGhLuYzpD7ymqOsk7x35o7Sr0/E6owY4Q6:jDWWyJbctI95mvWwhmQk7Ho7Sr0E/7cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608707, "uuid": "fc46d25e-3da4-4da0-8f52-c6f933dbbc90", "value": 24000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608707, "uuid": "8652b75d-59a6-4a0a-8ea1-6ea8bb1fb0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608707, "uuid": "ef8a2d2d-0973-43fb-8fb5-1e3fa0031f0e", "value": "niggah.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1addf68c-ce9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583460, "uuid": "a9855cfb-9a48-467d-a029-d0c8b2d757e9", "comment": "Malware payload (Mirai)", "value": "699bc5699814053534ce8fccb7daf521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583460, "uuid": "41a70ea7-a953-4e45-b263-1ac796648ea8", "comment": "Malware payload (Mirai)", "value": "c2dc5f4c3147eaa17c8123f6fb1425eb427b0e863670cf592d01a0044f8d8b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583460, "uuid": "83225a70-dce2-4f43-9bdf-f3d4e40c015d", "comment": "Malware payload (Mirai)", "value": "8f57da9679e31b0a2c044eb8349c7101b0d85a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583460, "uuid": "eac54bd4-75bc-4de9-bd02-9eba265b8973", "comment": "Malware payload (Mirai)", "value": "fd800ab9705a6c595a52fedd9f434bebcefd94c894c67f27a2e542fe9279e8a86c64b9db812701de385425abaee8438e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583460, "uuid": "3758da70-0980-4ad0-b4b2-1892d9381e22", "value": "T15E143B0B7B118FA1C36896700AF3CB6796E6269216E19985E76DDD107B3075C2C3FEB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583460, "uuid": "eb16e6cf-0eaf-4e54-a8a8-fcc1765a01a3", "value": "3072:xCU//0Ja/ImhT2tedH+8klhOhDSS5LHD5xp4go2pzWW9faP:xCU//1ImhISSlhOLBHPp4A1/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583460, "uuid": "0b9bf55f-33ab-458d-ba9c-7775f1643c9d", "value": 198760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583460, "uuid": "4c039a3f-7a4f-4cfd-baa1-878d75af512f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583460, "uuid": "f89b8b59-4b28-4cc2-b47e-c68d6466a3e6", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92e947-ce6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764562610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562610, "uuid": "6c166e9e-3040-46fd-af55-e7256ffc3ab0", "comment": "Malware payload (Mirai)", "value": "162147d305ee8eb4b43e05bc2adf9006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562610, "uuid": "b75fa94f-809c-461c-ac63-e8f9f23c4bbe", "comment": "Malware payload (Mirai)", "value": "c2dd9b762ee9c576c1d1a7c56fe3288ed8c4c86579b462597c0b9276a6433e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562610, "uuid": "c285b5bf-dd70-4422-a06a-ea26aa898bb3", "comment": "Malware payload (Mirai)", "value": "c547e37345feb03a8f4f0665896c75402915b559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764562610, "uuid": "8150208f-30e0-4c23-a88d-6f4fcf3d36aa", "comment": "Malware payload (Mirai)", "value": "2e15154ac8696863912ec57ceb14e1fabda9be59ce799443a70084b45cbe725634d2ee606f5114d1f2c468d2609cdd67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562610, "uuid": "4528509e-d8a5-4d57-a24f-f4b84134ca40", "value": "T119D3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562610, "uuid": "40879dee-1512-47c3-9888-3277f8df0cf3", "value": "3072:F0H21ZnmrUjUGcF9n4FN7njJL3sdugpgy+rq:Ff1ZmgZ64Ftnj6krq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764562610, "uuid": "d75d0250-eefa-4af7-88f2-06228cebb930", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764562610, "uuid": "854e9ea9-1555-4c60-b937-60c124bf5b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764562610, "uuid": "60ccccde-513f-4618-8712-f93513305631", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f16c486-ce90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764577991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577991, "uuid": "e0fa2b8b-e1fd-4bc9-b7af-a878e564220d", "comment": "Malware payload", "value": "71afc032342b400a00704cccc57815d4", "object_relation": "md5", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577991, "uuid": "d5c68b6f-009c-446d-a570-a1665fdc1a16", "comment": "Malware payload", "value": "c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece", "object_relation": "sha256", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577991, "uuid": "04b30de1-62eb-4416-9d04-6b9ec62f74ff", "comment": "Malware payload", "value": "389af5ce305d106cdb945fd3c33188ec2ae59805", "object_relation": "sha1", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764577991, "uuid": "7f8e384a-adf0-469b-b579-0b71c2cd1541", "comment": "Malware payload", "value": "5e89e374670e6315b3cd39984eb3eefe7d8ce3f0497f40752513fd122f3c25f980491be5d941fb8212272c9281095371", "object_relation": "sha3-384", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577991, "uuid": "9a4536df-a7d5-448e-a023-d1f5a8e616fe", "value": "T18AB33BCC6EA13361479773F1C4275E0F51BAE246980D8010EB3CD7C629ACA5AB5D7FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577991, "uuid": "a8e216a5-3f52-44f0-92d4-9585216de7d5", "value": "1536:q/7W6FtMZCqh6bBoN7Ua+P0ZzB3vOUrzZLT0rWLaPI+7zfbioataI0ca3siJ46jN:m9O3GUv1LosIca3sQ4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764577991, "uuid": "84e6ffd1-1feb-42bf-b138-d25b37d7c729", "value": 115332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764577991, "uuid": "5e79c128-a662-4c18-8b63-f1a199c1ff61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764577991, "uuid": "c8219fc4-1012-49b8-8cce-167962326c9f", "value": "stage2.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d45804-ceba-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1764596009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596009, "uuid": "7cfad2af-a74e-4f29-adec-01b071c0a820", "comment": "Malware payload (SVCStealer)", "value": "5547d9f8c74f8de260394205b0045ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596009, "uuid": "6245421c-e39a-486a-8820-3b10ba3e0435", "comment": "Malware payload (SVCStealer)", "value": "c38153a496b6b297bcb2682b56bdfdecacf9d4c72bb04790f8e677eb88f50dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596009, "uuid": "085e51b6-822e-4773-b234-b5225a1dec60", "comment": "Malware payload (SVCStealer)", "value": "9fd7832a9f25a880333902af15101c9e716156b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764596009, "uuid": "f5d041bc-1272-46d4-9f3d-33e55f76fba8", "comment": "Malware payload (SVCStealer)", "value": "8c7ae289a3fa390187a623adfacd3d01d7dc6d76a7785ec8579bdd799f28a5c4e39a41608eb5f977c204fd73e1e150bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596009, "uuid": "7ffd52c5-065a-4145-8335-e134f61bf70c", "value": "T147148C243680C072E4B7027145FC9B32597DBE620BB156DBB3E80F9D8AB45D26B31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596009, "uuid": "6d04912f-df23-4348-aaff-6d7969a0b005", "value": "9d20241135260a6283527b95f11fc551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596009, "uuid": "cc6964b6-10d0-41cf-a70f-0839ba606da6", "value": "3072:GLkiHgZn7CNFBneOI7Aeq63oNZ4rKypSiDX9I24+lgNd+s0PWMelS:GLkiHC7JOI7+5Z4rWk9IHDd+sUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764596009, "uuid": "90293e71-a35d-4c18-822c-f7893bbf965d", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764596009, "uuid": "8f6044db-be76-4701-bc86-b8e04f0b7028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764596009, "uuid": "6dcddde5-6f8a-46e0-89b8-15d4d90a0899", "value": "SecuriteInfo.com.Trojan.Dridex.1505.11765.2335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a138a8-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621250, "uuid": "9f90a158-6198-4bee-9233-11d1d7a5fe20", "comment": "Malware payload", "value": "fd4bed46513c9879e695619cfe851a79", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621250, "uuid": "347f7ef9-5eb6-4516-8be2-007f9fc069c4", "comment": "Malware payload", "value": "c38961f4493641448c71aabe8b46796c4ef0c6aaaed187be02ff06ed152ae1e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621250, "uuid": "6d24171e-527a-4121-8c1b-bd4e2069807c", "comment": "Malware payload", "value": "9c87486674cba557d351fc5f0c996677bdcf5383", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621250, "uuid": "3428003a-c26a-405a-a1b4-cd66e2a70f2f", "comment": "Malware payload", "value": "1b5fe3ff434f878e980055611330f3cd2a60c2ba3d85832977907b024671d05078627cf0d4e0b64d16c99caa895afaf9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621250, "uuid": "2972bf0b-3768-46da-9a59-387f714238c6", "value": "T12F56F1C7F7D8A92FC8775072897E52B151878C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621250, "uuid": "1e69f17d-aeff-444a-9864-21316c9d05e5", "value": "98304:qkEoTwrYhK8Yofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltR:PK8HfyaIbaciAFvrEZpXqmY9XrF/mpCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621250, "uuid": "8a97db7a-77c4-4d74-a320-2553118e899e", "value": 5908430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621250, "uuid": "4995701e-3449-4354-ad32-39c8af048442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621250, "uuid": "ab93adda-7da3-4198-9edb-f2d6264ad9ab", "value": "Superbet388.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228ff125-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621269, "uuid": "4f919274-f67a-4b74-96d2-69e3e62e051d", "comment": "Malware payload", "value": "5fd7bbea4521750e4575452071126e18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621269, "uuid": "b4e863f5-b69e-414d-bd53-8baa98cc7e7d", "comment": "Malware payload", "value": "c4259ce5d7a71e6d4a3f17f3675250f840e4b9c1b9ec89ad8319bf3916d281c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621269, "uuid": "d79ec6c2-4b97-4409-8f95-9ad3c286639d", "comment": "Malware payload", "value": "01887353db75835d6644ecd4e6d1e1fac6151ffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621269, "uuid": "f4db70a1-baa8-4334-b6fb-236ab9a9e3f0", "comment": "Malware payload", "value": "506f4f2570c07e4aa36ebb8e9681a1f6ffcb3b9768624f0ced3e228ecd8d72c0a1e0e0764d25d27e4f7f013d63ccecc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621269, "uuid": "3416845a-4dcb-4d3b-996b-b1833c290008", "value": "T124753334DEC68B96D2B9A7DAAD6DC3D0F90A97187B894EE44401DCC62D34E7C8613933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621269, "uuid": "8b50f6e3-4554-4258-b85d-c87ad32564e3", "value": "49152:s1aZvWgiVblmavGsygKV2XgOViLeh4PD8n:xpeblLOsXNDC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621269, "uuid": "436c1a48-b353-492a-98a9-56e90d773bb2", "value": 1681436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621269, "uuid": "66bbf48f-b0b9-4143-8b7b-ad07050b114a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621269, "uuid": "a050019d-96fd-44bf-8d2f-c014da67e18c", "value": "fubuki.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6dfa76-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621555, "uuid": "c079a111-6f79-4ad3-b829-58fd50ff4a6d", "comment": "Malware payload (Gafgyt)", "value": "7f1323e83514c43f589b7f0b1b8f62e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621555, "uuid": "f8745217-04b4-43ba-80c8-c34188bfc17b", "comment": "Malware payload (Gafgyt)", "value": "c5cf89081aa6911272d7515084c87c5d672dee9c86a6308083c38b2b7b6f9e47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621555, "uuid": "8244412c-3172-4c81-9d2c-39b010eaa23e", "comment": "Malware payload (Gafgyt)", "value": "4e3387f4559fcece867099dd47ebcc9da45ccef1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621555, "uuid": "e9bb199d-1df7-42a6-93fa-12d337936cd1", "comment": "Malware payload (Gafgyt)", "value": "8d28d10ffd08722419516d67dce76b222dab7ee3579ac9d3fbb6eb4db9bfae24310cb990d10226aa4fb139b369e1039a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621555, "uuid": "4e2953b3-fc32-4f34-9905-65a37c198792", "value": "T11E04B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621555, "uuid": "b588a6f9-02ac-4d85-ae7b-c41517b7f194", "value": "3072:UhZRj5n9EmzUyMhu5hWTt5s1qAuhmv8uqx1BVnKoe:mjrYZu5hWJ5Lhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621555, "uuid": "394bb674-479a-4e73-9062-b8078e30bcc7", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621555, "uuid": "35522897-e9a8-4ea6-93cc-8c633be06f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621555, "uuid": "9bc3a06e-f74c-465c-907a-e0d9fbed79b7", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1b0518-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621556, "uuid": "01695b64-ede7-4b49-92d7-4b15788c33c0", "comment": "Malware payload (Gafgyt)", "value": "6e09df802d6b05e87cbf6b0f619f7527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621556, "uuid": "f1bb5f92-5760-4fc0-87c4-665cc5cb5a17", "comment": "Malware payload (Gafgyt)", "value": "c622d8e30fa58d1cc21c02a72379e337dd8efe47a9e052fc40a0df593b1f6667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621556, "uuid": "e07b5f35-dc0f-4c68-9084-e035a45a1c46", "comment": "Malware payload (Gafgyt)", "value": "9a0c2007411da7d095cae803422a2478da51d113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621556, "uuid": "5fc2d1d8-349f-4e6a-83f6-8f106f00cf56", "comment": "Malware payload (Gafgyt)", "value": "bc7f5a7c1bfbea08e4c94c6761bbce11ef51d13f7455c0c4a555e81a7446af793cc1e6e4ef9ab31ef91b32aff83c9a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621556, "uuid": "1041ba93-fc00-4e75-b841-3ab0a4011328", "value": "T156F33A24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621556, "uuid": "eec09151-a78c-46a1-8b64-160d22307a7d", "value": "3072:cyd1BPL8Z60aMnGjuog68Fi5Lo5hM1D1/6JrTRxmfQOYbr5Wn:Lz060auGjJ5Lo5he/6XxmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621556, "uuid": "0715f5bc-4fdb-4689-88ea-bc11932066ff", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621556, "uuid": "24a09c2a-7657-446c-9890-b19a7bb6555d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621556, "uuid": "604fa19e-b161-42b6-be26-596f22912d31", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6395295-ce4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764549334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549334, "uuid": "b5cace6a-9baa-4aaa-94e4-46ae761e3bf6", "comment": "Malware payload (Mirai)", "value": "aaf5cd8ac03f773e0086ebc5b15fa426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549334, "uuid": "7d4fe409-9a7d-480e-933a-e0e88b5cb661", "comment": "Malware payload (Mirai)", "value": "c627a0523b9e552988e0496ea06c91b6095f8e9ff5d03393f64bf1d95b306567", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549334, "uuid": "25189287-d552-4849-ae65-ea3453aa81f8", "comment": "Malware payload (Mirai)", "value": "585ef5878d05b058f4f936fcda8f04b7955151de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764549334, "uuid": "8c27fb27-f1b9-4dc2-b2cd-9e9a993cc910", "comment": "Malware payload (Mirai)", "value": "3ba7402b98640e32f7c1719111e9a580c7302394a7329b5e87eb3a9cd3d72f50be95e56906f08d3b10f6bc66a1b6fcb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549334, "uuid": "b6bbe401-2e75-4f2c-a0b4-4824332aecf7", "value": "T129A3BF32C82A5D98C18505B8B4EADE365B23E5C417932EF716E6C7B65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549334, "uuid": "23593530-fde8-4d6e-a0cc-461ce8c94478", "value": "1536:H/I9A0n3bQK05LKGVwS0k2qcKDFVut7DAQmHICwE6SPXc5:Hw9AkrqLK/k9DDwAQmHIEvvc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764549334, "uuid": "9072f101-d00b-4d83-b93d-537c3dead712", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764549334, "uuid": "6579baee-db04-4ac2-9bce-753aa9338737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764549334, "uuid": "46e079a6-5851-4eed-963a-e58850a26150", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fcac0f-cef9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764623103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623103, "uuid": "5bf89388-c595-4830-81f7-b48382a231ea", "comment": "Malware payload", "value": "15a1f100b50d89f1cb36fbb0aa47a417", "object_relation": "md5", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623103, "uuid": "cbee37c9-95fb-4471-92fa-b54daa987f21", "comment": "Malware payload", "value": "c700aea61e06b8c3eb77eb63391433bb37df6da60ea2e6b31d701c159a760dca", "object_relation": "sha256", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623103, "uuid": "c888b18d-c84f-4bfc-95d7-5594ce4df269", "comment": "Malware payload", "value": "4ef497a947d5641b29ca6624355e17a840ad4e39", "object_relation": "sha1", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764623103, "uuid": "d44db55b-f45a-42a1-a5de-3385d99c320f", "comment": "Malware payload", "value": "393acbf912401f756718f15848dc3830bec8a73618360fae35edd8fbdba8711991464f6d263f2f7e339b57a9f7fb16f8", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-247-228", "colour": "#DDB7C7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623103, "uuid": "961e80db-059e-4fa8-87e8-c1d45fc87f8d", "value": "T1A7C6334B88FD2357EC5B73341161DA4B566FC7A2B002A96B5D0E82E46C83CB89F3E517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623103, "uuid": "702cfb39-2046-486a-a815-df6cc7b3b348", "value": "196608:wt4aWuiasbfxjeQEx5tO1aIFqTBw/JY7QBU1CSgk08LEaXVAPoSObwdsh8p73qVh:wtsFayo5Qf8GK7QBs0QxWPBGwdshEYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764623103, "uuid": "c354b74e-e376-48a0-872d-f7f78a0ebb6f", "value": 11999783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764623103, "uuid": "add55ee3-57d1-453c-b7b7-fe8890c999ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764623103, "uuid": "70c5e1db-7522-40ea-aff4-c81057aca17d", "value": "NvDriverDiagnostics.md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b85af01-cee4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764614143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614143, "uuid": "d97a04e5-6591-40ae-84c6-dc8fdcce9d31", "comment": "Malware payload (Mirai)", "value": "50d4fbe6ea57dc9006b5a7f2aad40c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614143, "uuid": "070f3935-a2f3-4612-b567-df480317482d", "comment": "Malware payload (Mirai)", "value": "c7314bfbe7ebc6b00f0c02e03d1fe6296e80cbad9ca222c67a4184d057e42480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614143, "uuid": "8cb9288c-7345-4cd3-b007-b3d5de65991d", "comment": "Malware payload (Mirai)", "value": "99daf7c1a45b5c241e6f16afbf6c589fadc51bc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764614143, "uuid": "49b747c4-af73-4a10-90e4-5e0c9f2d2bcf", "comment": "Malware payload (Mirai)", "value": "73e437821ac02931c9397dd01426b1be2d4808807b0f90e26e22d94767b0a46a7f62eda384472666af1149c5153cdc07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614143, "uuid": "9db08694-9385-4d14-b10f-671f316ead12", "value": "T1B0935C42B62C0E47E4A35EB4263F17D193BFD94024F4BA88695FDB1A8635E361086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614143, "uuid": "5ad0b550-7821-49d2-ac7e-bdf9e0ce272f", "value": "1536:uDRyFMBpxh0wDSUiOYI5k/eVUQtQFDfB7hy3w:ukFLTOZkGzQFDfkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764614143, "uuid": "efc3f651-c3f3-49f1-b106-1d31a0845179", "value": 93556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764614143, "uuid": "321bc001-311d-446d-a9bc-b4c716e2ad44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764614143, "uuid": "384d8066-7e30-483e-8471-0a8162705c97", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffefc537-cefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764624217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624217, "uuid": "10e2a3d0-e075-4f53-9995-07c0b800c309", "comment": "Malware payload", "value": "e3ca702505aa8cc3944e0bbfabdceb40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624217, "uuid": "7d334db6-7485-490d-93b9-c627d83f1c86", "comment": "Malware payload", "value": "c78ca6ee275aec8ce7513d31c5332e1e7ad7742308d0ce3d70393aac4fc4ea26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624217, "uuid": "51dc7f00-cd7b-4e7c-bf23-2e428d448ca0", "comment": "Malware payload", "value": "b290f5a3bcb2532facabdc09b75a4139105d2879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624217, "uuid": "81e5f6c9-1cbe-4fcf-b30b-b1f62c4ed9f4", "comment": "Malware payload", "value": "5b3e2c92da7eb26fe1f445d6c24bac574b2034ac19fdc9454b0e5d83eb8f852ac005f09f356b68eaf57f9a7ee61faa03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624217, "uuid": "4824569f-fd34-45b4-abac-a0dea1a61ea4", "value": "T124D312ABCCBB89CEFE6A8FB52657094F0DF6E1D4E5843D98453B108027F8256A514F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624217, "uuid": "fd335c9e-eb15-4d6b-bace-72a7ca790e66", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6con:7O/QJHZweEL/NOjCHm7FZZnca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624217, "uuid": "f102b8cd-1d88-41ac-a01e-5995cb3af066", "value": 135660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624217, "uuid": "1fd4fe13-b94a-478a-a017-668d9ebf2775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624217, "uuid": "c68e3303-4420-444c-b548-00c8f6425c11", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0308962-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621560, "uuid": "aa15702d-b83e-41ab-be25-81ea1daf729f", "comment": "Malware payload (Gafgyt)", "value": "58f3b6fbe82faf9f5fc6b7943d076e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621560, "uuid": "871ff7dc-bb0a-4c68-a42b-b03218e12fdf", "comment": "Malware payload (Gafgyt)", "value": "c819761ed9dbbc82bc4f06a0e0433f0320bc59818b88b1076786b170e7599acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621560, "uuid": "d97bc07d-b629-49aa-ad63-e5e4891bfa61", "comment": "Malware payload (Gafgyt)", "value": "ff1c65824f9830ad6db6fc12534add8e0bf42eff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621560, "uuid": "185a7c78-1655-48dc-9257-40a97bb9d616", "comment": "Malware payload (Gafgyt)", "value": "c6f290ad3c904109b4356a865f2d5b5d18553b7f2b4ec5271a7d9d82a777387af070cde16741b4a1569984ceb631b3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621560, "uuid": "6f862c03-2011-4fad-9499-264509d91fd5", "value": "T1CA04717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621560, "uuid": "668b6a9a-9aef-464b-9417-9d41b222fb64", "value": "3072:aaF7XSy6Cv9RDf5hCs1ZQhmv8uqx1BVnKoe:aICGVFf5hCZhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621560, "uuid": "e25f4285-60a7-4d18-94d4-3370e9e791ff", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621560, "uuid": "96473318-3d88-49d9-914a-058d72183076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621560, "uuid": "06365c54-b149-478c-9518-b53d5c621d6c", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a999a9a-cee7-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1764615242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615242, "uuid": "7fabfd5d-f6c8-4926-9ef0-7069a64c8171", "comment": "Malware payload (GoToResolve)", "value": "91e4b3c684577bbc083a7b132b49b520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615242, "uuid": "1e78067e-59c9-4f65-8996-4444459e7cdf", "comment": "Malware payload (GoToResolve)", "value": "c92524830e27d62769727c44709dad2379a7545d39d2878075ea57149d84ebd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615242, "uuid": "a68b0acf-5457-45d6-a76a-c7c6570a56d8", "comment": "Malware payload (GoToResolve)", "value": "d5fa6ad5e3886b51b7475620664c7161cf7c4b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764615242, "uuid": "fe1e60f0-d3a5-43ed-9c61-7f5f55c2b18c", "comment": "Malware payload (GoToResolve)", "value": "f4f5869b96c74a275f6c5c9afa5f0f9e27f86b5caa7e073dbdd590dfff3fd42148dcb980613c9405b5d4e07ccbb45332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615242, "uuid": "90f1b9c9-773e-422d-983e-2f31233dc90c", "value": "T13837333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615242, "uuid": "eb652fcb-0dd5-4703-97a7-5ee12b236ed3", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615242, "uuid": "1c81583a-b8c2-4ac0-b723-c35f078933be", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpL:q9WtLzgOTbjZvk/ekS/mcpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764615242, "uuid": "4c978f65-33d8-4763-9f4e-e7df33f0869b", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764615242, "uuid": "218f72b2-d1e6-4b59-a36a-f5654da7873b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764615242, "uuid": "0a0d5b30-0784-46d6-8c43-ccc5d37bbd24", "value": "INVITE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2232753c-ce7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569728, "uuid": "fd696acd-bb32-42a1-92cb-45ddfd3d9d77", "comment": "Malware payload (Mirai)", "value": "e00df1aff1e2e7276385b112210a578a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569728, "uuid": "f1d733c1-ef83-452d-8897-c0b4305cb9c3", "comment": "Malware payload (Mirai)", "value": "c9b2fc8d78f468fca8d5b67059bbaf94f5bbfabbb42b1cfa2d07be387666d33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569728, "uuid": "86cf19d4-bc15-48f8-b953-3e984ef11222", "comment": "Malware payload (Mirai)", "value": "979cf6adce789d45d475751d0cf551d194e8815e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569728, "uuid": "c44e021a-c84f-4a4f-b2ea-2160b8054601", "comment": "Malware payload (Mirai)", "value": "4c99fb65a8e047670a8490a39bb9b777539854830726747f6dc7a26f5170db3f397bf6afb3e3e10a0020c1f7c2c3d56b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569728, "uuid": "82186dd0-b461-4f90-a119-09b47682b56d", "value": "T1ECE3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569728, "uuid": "f9a289d7-598f-4187-b232-cf667f6d8b9c", "value": "3072:JjpvwdERKjZyMk9GBeRYUZraCX4Dq9rg:JjFwdERKjZyMRBUYUZeCX4Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569728, "uuid": "a8dc3d40-4da9-4273-a95e-6d98ecfe5245", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569728, "uuid": "c49748ec-c1e9-4df7-a9de-ee7a64c055b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569728, "uuid": "afdf67f8-586d-49fb-a6ea-ba89ee156d46", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d7297f-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621172, "uuid": "255cacee-5dc3-43de-a139-9bb1608dd735", "comment": "Malware payload", "value": "7efc6546196d591104e9d86d579844b4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621172, "uuid": "81acffed-4813-406e-bb4d-a7a3118ded0d", "comment": "Malware payload", "value": "ca5b40e938f68321dfa3a7f1ad2a03db4ff6ba27fdae5e230654cd5c30090692", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621172, "uuid": "11ecae7f-72ff-48eb-8a53-33ed033d707f", "comment": "Malware payload", "value": "aa8f7c61896e8b66b7c1eafb787b716f5ef21258", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621172, "uuid": "47c30ed9-16ba-48e7-995f-6016df68c0c0", "comment": "Malware payload", "value": "6c8e1e9aba1c67d53666a2330d84b18e84f29b07173df7c3c7844685fc06a1caa2419b12310858f46c6735000d743d88", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621172, "uuid": "c14f55af-d7bd-4bb5-b081-212a4a490859", "value": "T11B961203F78E492ECED2B97849A3137166056CEC2950938F4902F218BE776E96F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621172, "uuid": "72245e3c-2649-4182-81d3-33380d30ec53", "value": "196608:whNDnABoG3N/CDfIn9RoKbMAGhBUbAIRUGexeCTAUPFVY9f+S5X:whSoG1Cc9RXlAFdxeCTAUPFVY9f+S5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621172, "uuid": "f992161b-bd45-4fba-a9cc-e57d2c811c2a", "value": 9409801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621172, "uuid": "a530f3c5-85c3-4bc4-b700-beb1cfd25435", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621172, "uuid": "b06c0229-d27d-4a55-91e7-34ddd1d10e73", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2cd451-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621313, "uuid": "bb1fb05b-5bed-4afa-9bf5-8406c33a7d65", "comment": "Malware payload", "value": "16d1922f77e86628c7f27d5640501e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621313, "uuid": "46bafee1-6768-4ca0-9082-7c2e9f079f56", "comment": "Malware payload", "value": "ca8b45135139eb0b66f85a95a03a30a71410c2f5013a45d1e8409e37ded9a909", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621313, "uuid": "99023072-4d27-439d-8766-65dcbb20baf8", "comment": "Malware payload", "value": "20bbab89cc3aaa3f7019b776e3948da8f1b43484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621313, "uuid": "d759d8a5-38a6-4b6e-a177-d9b3b84f1269", "comment": "Malware payload", "value": "bde62334492aaf2b9623c54c11f2543c1a169d6ef0e8cb992ae73d6666824d64bb462f541ab46f256e5f32425efffbf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621313, "uuid": "50585195-4139-4128-9eea-d1cb0b0204b9", "value": "T10F7533BE274DBE198EB3937B71371A15007D375EE07163E6AA378589588AD8F60B2C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621313, "uuid": "ccee0344-9606-4d71-9a75-ed10257a2b40", "value": "49152:oZh04RBRuo5/jvIVXdrs7MjZ2Rp2k3DlGR:Y04huoFvIVXdrNZ2b5zlGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621313, "uuid": "f9dbdebc-6293-423b-8a5d-52eba5482f60", "value": 1690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621313, "uuid": "7b4eba7e-8a0d-4595-8b01-c4eec91dea9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621313, "uuid": "310cc1df-fa91-47f8-a7fc-423f7fafb339", "value": "subaru.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81529840-ce82-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764572035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572035, "uuid": "442c3a9d-2851-41a1-816d-d906886d0776", "comment": "Malware payload (Formbook)", "value": "6a2f7f988aa30750c9200b269c7ad031", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572035, "uuid": "6d7fbcd5-f863-499b-8535-9bd33a7d2b67", "comment": "Malware payload (Formbook)", "value": "cb7e494eec2499017f80e1352915fa837fff394f04df860f1e622c0fe5f858ae", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572035, "uuid": "ec3957c4-fa88-4019-839d-7682a956fd47", "comment": "Malware payload (Formbook)", "value": "abc01aa6dcc01e8b437d993f4e3f86a18c9bb20a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764572035, "uuid": "025f2aea-2a6e-415d-b636-b06595191ce6", "comment": "Malware payload (Formbook)", "value": "c13466772e5a85b07958e629fca891dd2121e625b6af3572218c2d60ff66f40d60e7451c6e64ecfcc90fe683339dd6b3", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572035, "uuid": "89fc319e-61a8-4bbb-93e1-416402a5bbc7", "value": "T1F5E4227719CE3C7DD20D8EFE55277032BA642C96967A3595A84B23CD0F00AAE29051FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572035, "uuid": "ad67a3e3-7fe2-40f2-8419-ece304b33816", "value": "12288:+uHgnDhA4F9WKLo4faFMUwKlIZJvltcNFoRvCjeLaJY0kj0nSrGFEJ6ZSym7lRlz:+2gdrFt1CFhwKlRACaL+Y0kj0nKFWSNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764572035, "uuid": "717abe22-7e5d-4eaa-b8bd-65d804708326", "value": 674743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764572035, "uuid": "f0bbe67f-18d0-4a4c-a59b-3a78825dd188", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764572035, "uuid": "08f3743f-05a1-4a5c-a0b0-aec062875b67", "value": "Deposit_Remittance_PO_2025-11-28.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deec58d1-ced9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764609559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609559, "uuid": "512d7ed5-af5b-4848-80d8-458d1815ab58", "comment": "Malware payload (Mirai)", "value": "e5dd3ad4c501f828a7096cd4607f098b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609559, "uuid": "71e2d2ed-f82a-4109-b8ad-6832c58de2cf", "comment": "Malware payload (Mirai)", "value": "cbb7583e642fe0d7778ed8548f3940a4028d769f1e83e24128d24b00aaea829a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609559, "uuid": "8ee456cb-1e99-4247-bcb9-1284d121bb6c", "comment": "Malware payload (Mirai)", "value": "8f20714482f8d1c351038c064505ba3bf61807a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609559, "uuid": "88fd2e10-5ace-4b5d-b2bf-735408f207db", "comment": "Malware payload (Mirai)", "value": "7cad1ad6e5a9ff9c003d4e1682b1a504de8b88214429782523f6be2403bc7f815e1e51998618024519598899c68853d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609559, "uuid": "47dc71ef-84ce-4069-bf67-791c6449aaca", "value": "T1DEB30755F8829A62C6D256BFFF0F828D332613E8D3EB3213DD185B6136C656B0E7A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609559, "uuid": "fa3f0bc4-676d-417a-8dfa-1fbbb878e97a", "value": "3072:64jXdDE9ezREU5QxMxdUwAmKXXi8V2vrbbsFDbsbBpoB2XLn5g:HjXdD0ezREJxME5XXR2vXsABpk2XFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764609559, "uuid": "dfc3b71f-9dd4-4e8a-8dd3-64dc739688b5", "value": 111764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764609559, "uuid": "1f6daa36-c1d8-423a-8a1d-438a99a7113d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609559, "uuid": "fd8eb6d0-5c37-4f8a-9553-e21305741d78", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108b90fa-ce58-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764553807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764553807, "uuid": "89c78724-3cd9-4f67-95c1-f2b4952a33a4", "comment": "Malware payload (Loki)", "value": "632568cb2adde20bae264e09e8ef9502", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764553807, "uuid": "ca828d40-c9f6-43c7-9e53-dbe4f3010a95", "comment": "Malware payload (Loki)", "value": "cbf238a9bec97b767fe53b13949f5acbaa30c40692216e9628f5f71842c60889", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764553807, "uuid": "d6a92ef3-4d0b-4e49-a759-b1ca781c4223", "comment": "Malware payload (Loki)", "value": "87f4659a463e7eef6970ec81dff07ce632693a23", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764553807, "uuid": "c79d70fc-d060-4cec-a5a7-6bcc36614cb3", "comment": "Malware payload (Loki)", "value": "377b48baa278cc0b2c8093b3d6c9ec547d57f48889ba1f27c07a21790e0022868cc50320907f3e4d85a072b27014cadf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764553807, "uuid": "dae107f3-8f4f-4070-9eac-85b167f2078b", "value": "T17CD3C07874B5EC17FA65C0300EA7C9BEF729FC4468C1410717167B2E693A2E98B66B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764553807, "uuid": "c791ee9b-1332-4898-88d4-ef6d656e2259", "value": "3072:1H/pTzyqtdQ2YJlAZiV8TtnAYZv76N7X872:B/pyqvQ3JleikBZj6VXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764553807, "uuid": "05d770af-d86c-4910-b15b-cb9677b753a8", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764553807, "uuid": "8ecb6b4d-9237-41f7-bbf8-d4f291874382", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764553807, "uuid": "13b686fb-7552-4322-8e3c-ad98cae34d1f", "value": "Payment.details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895fb6b-ce6f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764563807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563807, "uuid": "63774856-b6c7-4e95-ba8c-5727909be55e", "comment": "Malware payload (Mirai)", "value": "6a5f463e470ebffcbdcd4de4b357b40d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563807, "uuid": "dbdeb097-6990-455c-a51f-be4249086810", "comment": "Malware payload (Mirai)", "value": "cf65e78b52b19e3ac5a1a3f10f571a60fd11b47a72e47e54bad00dcc10624166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563807, "uuid": "c8c497cf-fad0-40ba-ad54-e6b6be53389d", "comment": "Malware payload (Mirai)", "value": "cada17027c48fa89078096537bdbdacf6fb21de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764563807, "uuid": "4559ef54-cd01-4434-8e99-ade0e0ecefa5", "comment": "Malware payload (Mirai)", "value": "4045d40be9ad7d7f14ee44c3fa64bb8b3bcad36d301e173537836f0b3663ff873961cd3fff4e63d6c9a83355c7cdb171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563807, "uuid": "6dcfebe8-baea-4eda-a3f6-3dc47608a3a9", "value": "T16623F2786E40C157D96398F55FB11F810FAA3BB30107D8B6E049C6E9EAAA1B429C7CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563807, "uuid": "520ff3f8-4cdd-45f7-aae0-a7d0ace599db", "value": "768:O+jm/igUe0HCLCO63QTxr4p8EJNZiRgXZQCOFGUJ5xw9eBUJe8oHAuwivreAl7sl:OFigU7M6q4mE7oKKCOoUJPw9eNRHXwiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764563807, "uuid": "dc1bfe57-3770-4371-861d-4fbd7058c491", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764563807, "uuid": "869afe96-f2f5-48f0-b438-92b073ba6bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764563807, "uuid": "3523e220-a832-449c-a82e-4bcb7d206783", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74003d26-ce6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764561705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764561705, "uuid": "c2f887ed-fef5-4e09-8703-8072c72ed82b", "comment": "Malware payload (Vidar)", "value": "47d7019bc851fbc94dd4610a0fc75461", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764561705, "uuid": "b2949305-b665-4638-b220-9d673d9eec7d", "comment": "Malware payload (Vidar)", "value": "cfce32df271f8c5fb77dc950b3d6aa6c094c83fe0b6744f4f07c796908a7f2cf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764561705, "uuid": "398f08c2-fee4-4054-bab9-b1c92dc78a41", "comment": "Malware payload (Vidar)", "value": "ebd5db5a92666faf86e1dfa30f7c831e26407121", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764561705, "uuid": "244961c0-3933-4435-b96a-f52fda1b118c", "comment": "Malware payload (Vidar)", "value": "2ade0664e810acebed9c395c7bda1cd7e4b13c42ff2f6825d209a514277047363049ec276a53540d2589b05c7f391726", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764561705, "uuid": "eafeb20c-d5fd-4961-a7fa-0d00fe562bc5", "value": "T106D5331BB9E4C133C9951B3198F402636535BCB40929C243335BF5AD9AA7AC7F4723AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764561705, "uuid": "c498721c-fb28-4af9-81cf-2310fa155fc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764561705, "uuid": "f29c06fd-4a15-43ea-8eb9-6ccdcedf640f", "value": "49152:6PhDClEKKwgO+83wfeZeeUa3byymWkNMfUR92682o1eLOV2uaJwlSD+Z:L7sRMw2cFa3rmEfU62T4VaJwlQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764561705, "uuid": "52644fb7-d6a6-4366-9128-3105577ca26c", "value": 2858936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764561705, "uuid": "b9fd865d-18f5-48d6-b411-b25420eb810f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764561705, "uuid": "bfb5457d-b9c7-40c1-9b53-102ce488fdb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172961f4-cea5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764586890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586890, "uuid": "d09f47c2-238e-41c9-bb53-6c80d369160b", "comment": "Malware payload (Mirai)", "value": "411d843d48668aecfd32506bd3745026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586890, "uuid": "90656846-c967-4f0a-8aa6-a59385f66ef6", "comment": "Malware payload (Mirai)", "value": "d029bed4d3a2ffa7f0e9f3ebbc97a2f08d09500c0af3f68c2b001d20e186c3eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586890, "uuid": "c233cc39-d359-45c1-9fd0-afe09db51ead", "comment": "Malware payload (Mirai)", "value": "56bae138f538d3fdf14fcb48a69823ede8ba4f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764586890, "uuid": "622e1c6c-e45a-44e9-a7aa-74171db4924a", "comment": "Malware payload (Mirai)", "value": "99b1f1e2729dad6c7659d908d9119af84948d6ac60422d7f18758b5428cc5dcc5e66fc65222d5ee62fae5ad329c9c8c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586890, "uuid": "5ed06698-39b1-4deb-bb3c-8783aa7a08ef", "value": "T168F3292F258591F0FA811B746BCBD3A76C690BBF1095A0DF6B416329F6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586890, "uuid": "1467514e-be37-496a-918a-12327f2d6cf5", "value": "3072:nREoHQv9U9efe10/cFTEpAPJ1+A7BHG6qrOYNgozCNpyWKzr5502wUXZ:ny5KlvRsAQa6B6pWzr5u2Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764586890, "uuid": "142c327e-600a-4cba-9b43-f38e30793b53", "value": 172628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764586890, "uuid": "58c4411d-fdb1-4ddd-a3be-2e60d1769814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764586890, "uuid": "33931765-2a31-442d-947f-96848c8dbdd2", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f995efe8-cefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764624206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624206, "uuid": "e1caaf67-d03e-4011-8e09-f23da8ac9c43", "comment": "Malware payload", "value": "1de7a98b190a2e32b889f3e93e52ad2b", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624206, "uuid": "9a1fc40a-1073-4e34-8065-7a9e9bf0a972", "comment": "Malware payload", "value": "d0797a77efa7961e056e9c80302c8b23c08448821d8abd43d2be6c8ca2912e2c", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624206, "uuid": "c09001e0-60d8-47f4-902f-56c8ea68b8cd", "comment": "Malware payload", "value": "cdba1a7355e225e1cc43d4701d9e9452d0dc1b55", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624206, "uuid": "ec4141ba-0fcf-46d4-ace5-b0e476841f71", "comment": "Malware payload", "value": "67818896e07b11bbb31b60a3a23e399b361b2d7af66c9a0e248c15ef32778984ec2c0048a567eacde253051eb6854905", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624206, "uuid": "467a0870-1cec-471e-8cb7-81d241132c3a", "value": "T1F936F9336D50DDA2D1D9E134A4619291A22FBC4BC73D72CF1A763A6EDC763C22A35318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624206, "uuid": "bbeba4b9-f323-4cb6-afdf-04ce62aa2fc0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624206, "uuid": "7182b73a-0ea0-4097-bf4b-41b868209d0b", "value": "49152:nU8XcME1P7f4MMJsXrk0eIfcNJwwGvg+MwXD1vd2o:nC1Lv8ZoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624206, "uuid": "7751b1fa-cebf-430e-bb00-a61769240ec3", "value": 4931288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624206, "uuid": "7b4416c2-4f13-4b1e-9092-0d04f8b8c112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624206, "uuid": "84b38f80-015e-4b29-9b6e-25d7ea96d513", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d147d258-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621562, "uuid": "27340d4d-c3f0-479d-b0b6-59f5001f384a", "comment": "Malware payload", "value": "ef95fd2d2b2da3cfabdc2f53f51c5aea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621562, "uuid": "279b2c67-bfd3-4368-a615-0d57e1fe7a17", "comment": "Malware payload", "value": "d08578232f63c06fa9a0cef8c78d32e345be95ea005809d8beb390810467947b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621562, "uuid": "2fd5fbd3-c21a-48f0-8007-95e8396b1cea", "comment": "Malware payload", "value": "17f3046ad8018e8de3982bc7e2cd65f739c9f859", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621562, "uuid": "b3609ee4-daa7-4716-b149-c9ebab1a5efd", "comment": "Malware payload", "value": "67592d8f8784204a98081203d135bded26e2a27b540b470382cec60dade0b2584a87436b3a42bbae3ed3e5804dcb8fa5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621562, "uuid": "3c92bf77-aade-4eb4-9de0-3e1cc442af34", "value": "T1E3463394A3E00EE2FAA7903DD8B0D815D733B4260711E45746F447366F27BF1AA29FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621562, "uuid": "ae86cf43-93d5-4739-9453-7714b8e38d3a", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621562, "uuid": "d55b3575-d692-4949-9b27-7c5be2b27e74", "value": "98304:aIA7lEWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAxSSpXq0ez83q9DlAwdx:atHiouWJysVYvsOaoyMxxvjDDAxSSE/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621562, "uuid": "db8996fc-a710-486e-8fdd-36ebde1b044e", "value": 5841231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621562, "uuid": "64f7d9bb-c4ec-4e41-8ab4-2e6a243d6832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621562, "uuid": "d56986a7-11ba-41f0-8885-e886b183db08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d91f37-ce74-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764565950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565950, "uuid": "1f9515c8-cc2f-45b7-be81-bb4a361d38af", "comment": "Malware payload (MaskGramStealer)", "value": "29e7a40a2c0b46116131484ba44bbba7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565950, "uuid": "2046498d-007c-4399-98c6-40f8476792a2", "comment": "Malware payload (MaskGramStealer)", "value": "d08588efadb8f37b16947e09637e272fdbbcaef9bcd821addd56bdf157fc0cb3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565950, "uuid": "cb49d337-7bce-4240-b1ec-88e65c5410d3", "comment": "Malware payload (MaskGramStealer)", "value": "3905ab14593b9330ecc32f56b559e91089b4b0a4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565950, "uuid": "545e2461-adff-4f6c-9163-172c090c85fa", "comment": "Malware payload (MaskGramStealer)", "value": "0ab3f9053ac4bba2caec1eb23f65f5c00fcd8f186f8d9a44cdb5e343bffff7cf8161e221faa33b01535b958592fa5dd2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565950, "uuid": "97d0b49c-2948-4032-99a6-abd1bafbc667", "value": "T191A50209108708ACD94DAD35F297EE3ED0628D34D8F7593D167BB01ADA3A2E211CF65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565950, "uuid": "a8e33f91-c09f-4ee6-a5c3-e51b5eaf4b7b", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565950, "uuid": "68865b5c-5aa0-4b90-a4f4-2648905e8176", "value": "49152:SukPEx8uDrsSuPrs9Tkx0KGLb2wA69poU52+qWpMUSs+ry40:K8xKrHxubzbzuuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565950, "uuid": "9c272739-3003-4cb5-9528-adf125ec0e2a", "value": 2124800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565950, "uuid": "cddbd724-84ec-4c1e-a911-0950a3215109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565950, "uuid": "69407813-a389-43c3-8718-e1b78cf0a6a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733d5009-cedd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764611096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611096, "uuid": "96bc7264-5eb3-4c7d-a005-eabec51a8b2d", "comment": "Malware payload (Mirai)", "value": "6ad45fdba91655f11c31b7f09ae698e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611096, "uuid": "e1acca64-1b34-42b5-b36e-86da1a17993b", "comment": "Malware payload (Mirai)", "value": "d0986c336af6e6d82a47300244c28d0b546d5fb8dba15bd8356b9aa0803680b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611096, "uuid": "79314c86-128d-41d1-b343-484f9cee7183", "comment": "Malware payload (Mirai)", "value": "630e3720c49cf52f25a2d02ef102ba4afcd3dc5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764611096, "uuid": "7420fa31-c4e9-422c-8590-49424a126a72", "comment": "Malware payload (Mirai)", "value": "b0f34f0ff76258b364bb69ddb01c2732d60a9afa4a37b5704db342e757f3c0f1d53b7d4c36eff394935f94bdc86c006e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611096, "uuid": "21ed8579-282f-4562-8b44-189cc1de5fbd", "value": "T1ED246386AFA03FFFD85ECD334295DB09129C490A12947FBA2A74D518F68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611096, "uuid": "61feea65-7460-40ee-b875-783e0aa694f8", "value": "1536:N+gBwtdaiOsaXVDInSAM35v92T7gvbDr4992AaJOVcUF6BpgDoTG18El2Gn5p8HW:N+QAdaoatVI7z7wNZBpgUTGrn5o/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764611096, "uuid": "db388054-22bf-4f1b-a978-9a286f37fb09", "value": 223480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764611096, "uuid": "2b266a22-e60d-4a0f-98b8-7b5caa600441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764611096, "uuid": "8081ba9d-4388-4058-8dc4-8d319743fb02", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd20918-cf0a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764630307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630307, "uuid": "c407ff6c-3045-4941-8480-d3ac8888f682", "comment": "Malware payload (ValleyRAT)", "value": "0f48096897448cf52c00b0fff9023e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630307, "uuid": "307f08be-3e1f-47e4-bea5-0ad9e29952fb", "comment": "Malware payload (ValleyRAT)", "value": "d0b6cd722e5580d67b3ce944f3efc4b8969627bc61b50c271c6cd586d86cb48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630307, "uuid": "8f19c653-7ab3-4ceb-a972-c26948cdf373", "comment": "Malware payload (ValleyRAT)", "value": "e4bbeadaf178316bf60e718f75749aacb0ea4707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764630307, "uuid": "dfe690d8-6e7e-4276-a64b-14754a26d56f", "comment": "Malware payload (ValleyRAT)", "value": "a1c01a5e7826d6bf5f7b022abba645be1ddcddd9791d9d58a6bdbe2e550382b2c577bf663e3d2541f777d67f003e2bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630307, "uuid": "e08e7fb7-1c6a-4d26-8ffe-b68fbe4ebf80", "value": "T1D4746B55B3E410B4F0A7C139AB635586E5B27812C36C96DF03948B5B2F2B6E00EBF752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630307, "uuid": "c1cd9654-404d-4382-bd1d-858f139de355", "value": "dd27fe214e86afa841e290924b110212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630307, "uuid": "c03b86ba-7069-46d7-b588-4a7e9deee498", "value": "3072:dN6mtrf2Icq8t3ekBqiBC4rZdv55vfmwKglyOnKNu0ecPRn16jaVSN3XBYbk+xNb:RuIyJXDvrXmwKglyOzj0pbxLsq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764630307, "uuid": "8ec56086-7b53-41c6-b7e5-50b1cd42ac14", "value": 338416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764630307, "uuid": "fc18da37-8b07-4e20-b54d-a8ad0677fed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764630307, "uuid": "c23b1765-a7c3-43c7-9212-ff1d82b07d60", "value": "0f48096897448cf52c00b0fff9023e9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faeac7f6-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608747, "uuid": "5b0e59f5-1b2b-4b4b-a971-d76926ec17c1", "comment": "Malware payload (Mirai)", "value": "a55c597915166074c12a3172c856bbbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608747, "uuid": "ac7be393-bfa2-47c1-9c3e-6883afdf3c53", "comment": "Malware payload (Mirai)", "value": "d1101fd375b027f90a9e2930c948289b173d1d438da86bc017dc6c919da24908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608747, "uuid": "a5b134c5-6b8f-4157-9d72-660a36e17f58", "comment": "Malware payload (Mirai)", "value": "2dedb98cdb5c708e2fcb99c295a915a6b0f2591a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608747, "uuid": "b05560aa-4d3e-4f1c-ac55-811a9cc5e808", "comment": "Malware payload (Mirai)", "value": "343cb024bb888f7cc42be40e35a66291296bedb8dddec04a273d79f1bcaf26fc90d01a8fe837aafe81bbac0365383ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608747, "uuid": "f5d8e01f-2cfb-4298-83b7-5d429850755c", "value": "T1F9134B85EA42E8B5FE6B15B20477A7538B76E4BA1124DB02C7752531FC13A10E63B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608747, "uuid": "bb59644e-07b5-4d83-972a-826df9b2a451", "value": "768:leMMyiURAX/YJESYpkBXuDnez4j8XP2Un5Pv0rv58foYS5cIU:lFibvYJESYpkBXEqXxndvEvg3S5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608747, "uuid": "bacf6230-6c77-43ec-8287-bfae158077b6", "value": 42256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608747, "uuid": "0767024d-a1b6-4a1c-89d2-9ac398b504e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608747, "uuid": "0f76abba-6fee-4ea8-b5c7-404227dab2cb", "value": "niggah.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c1cf93-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608703, "uuid": "6953b76f-8950-40a9-b47c-f789fe5a573d", "comment": "Malware payload (Mirai)", "value": "a3835d95cef663fbd52f8cdece1bffbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608703, "uuid": "323d801d-28f2-4cd2-8783-89dae6d9a7ff", "comment": "Malware payload (Mirai)", "value": "d1272759c4b667bc2bb4dbaa3f12f7fa057d42720c4e7f04082e88f80c3f082f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608703, "uuid": "8aff626e-042f-4c1b-9277-c389e90dc7ca", "comment": "Malware payload (Mirai)", "value": "9398941166285bce1221e08ac91d2366d4f972c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608703, "uuid": "1f3b5a63-0da4-4de4-ba33-cd5fa560ed85", "comment": "Malware payload (Mirai)", "value": "a7857abd594dc6e43db3219460574d17039405ea7e2592fa9634650b3bb9a124544c7987ea5fc99337016bba81c2802b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608703, "uuid": "08d6ff51-2f56-4439-842f-32ec69899755", "value": "T13362CF21796D7836CD704C35E82C488FAE872BF592AFB827C354959C6EC54432FBD242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608703, "uuid": "8045f787-87b3-4973-87c7-d3871586dc29", "value": "384:A6aPktA7XJbppdpcFv5g5Ke3h7qmdGUEpiafMxK:ntA7BdpWv6Ks9q3UELfMxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608703, "uuid": "f4ab9233-0456-4407-ad57-a5972405651a", "value": 15928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608703, "uuid": "b18a90a8-119d-4ed4-ab6c-495addd6698f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608703, "uuid": "43bc4ae9-0422-4a14-81ff-bc14c0d1cdfa", "value": "niggah.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737bafb2-ce74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764565999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565999, "uuid": "9ce6c4a9-bc9d-4ae5-9e8f-fda1e9ccdd06", "comment": "Malware payload (Mirai)", "value": "a10128d75725c3d2f6c0cf8b9753602e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565999, "uuid": "28dff01c-2d61-455e-b0b8-7564975ab7cc", "comment": "Malware payload (Mirai)", "value": "d1c1a68badb2dfe95ab0bcdeb97cda47ef959253fbf64d151432c70828187d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565999, "uuid": "514b92ee-b85d-404f-aae0-b2aecc6942b2", "comment": "Malware payload (Mirai)", "value": "46ede6ae64e1b8d6a6e143110baf05d9a711c0ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764565999, "uuid": "d0689828-2e78-463d-ac86-a25d758dd808", "comment": "Malware payload (Mirai)", "value": "d91e63ba43be7cd827221c33144e7a06e5985eed179ceb3572d1eaa11ab7a9e2d4774e089cf0d5b9ea2b155c7866a3fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565999, "uuid": "8b34060f-c01e-4b19-b2a3-316a1adced88", "value": "T144C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565999, "uuid": "3340311e-033b-44f2-815b-c7a5830399cd", "value": "3072:HDWrFoeatGA59/qP98nTma9uk4cIXEuNGtj:HDWJoztGA5pm98niat4XEZtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764565999, "uuid": "9be46b6a-b9a0-4a03-88a5-bea0157065c7", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764565999, "uuid": "c9646364-3a39-4c8c-a418-a04693505466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764565999, "uuid": "41bfba9f-42e7-4ba7-a11f-f333ceaed2be", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f840ff-cefd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764624925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624925, "uuid": "256204cc-4711-47d2-8080-be2b204722b4", "comment": "Malware payload (Mirai)", "value": "5c4214e23595ec9525727fa1d52e27f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624925, "uuid": "fd878e9c-c7bb-41e3-98c3-b14fe8c9bcf9", "comment": "Malware payload (Mirai)", "value": "d2ea24af845b1bf794f1e3159f4420bad12c54b5da1b761c6571b01e83cc4d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624925, "uuid": "e3e7cd9a-3967-4c04-8ddd-f99ee92bcdc9", "comment": "Malware payload (Mirai)", "value": "53f49312eb6d3efe4aff7117fdf58d2628ca1ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624925, "uuid": "6c3cd66a-6d70-47cd-919b-fe9f107ce427", "comment": "Malware payload (Mirai)", "value": "6376f4f0c76b9a9086ea7cf75f9d7dcac50e9a048c3ee1bc1ecce8ef02598278cff6d4d9d4b520b771d1d4c6162e9c8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624925, "uuid": "34ad6b4a-ad3b-4d8b-b321-2260355008d2", "value": "T1FDA34A362A752E1BC1C0A57B11F30760F2F1479E26A8CA1E7EB20E4EEF2465061576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624925, "uuid": "6f4207e8-8511-40da-8eff-5e6e2775754f", "value": "1536:cnpJV3a0ERsujU5wJNE6jDjxLSlUsMhjkJrYM52tZsCHZ:GpravD/xuUlkZY8AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624925, "uuid": "2677f810-9c89-4e98-a816-20b986e3890c", "value": 99864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624925, "uuid": "5a2bd7eb-216d-41ce-a3fc-25ce5ab756bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624925, "uuid": "210c68ca-cdc9-47de-a339-568e5dea0b99", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bed7039-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621284, "uuid": "b5d338c7-9f96-44a1-bf7f-62831b548416", "comment": "Malware payload", "value": "02defb53a74dee43afd6c7ef13373728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621284, "uuid": "56068422-1e2b-435b-a746-8d139578e524", "comment": "Malware payload", "value": "d472c7ef1fc069fd1a8c83f04552f994153d6f74eedd138cd991c016ab46b22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621284, "uuid": "02e18b1d-bccf-418d-8bfd-aef041498c40", "comment": "Malware payload", "value": "36957c0bc6083a58ff01975103d9dd150b20196b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621284, "uuid": "a59fa61f-035d-4eb5-a517-ce300d2ca48d", "comment": "Malware payload", "value": "d7482cc36b71495b58ce6e20284a3d8ab8f916b89068cd20457318936b7fbc12574141cf677897816ba4f5427f3b23a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621284, "uuid": "944b74b2-7d18-4540-b89b-cd354a50d2f9", "value": "T19D753339F908B2FD9FF9D6506131AB09FBD41BC3AB5A18CB39B514CBA158841EAC13D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621284, "uuid": "c237f06f-254f-4126-a6c9-21c2a8defaed", "value": "24576:wtzzylnpeKgKKEgkf+XYF2FwYfyl8S5HgNzEG0Ns9+kmNV4c7ErXn7IpcbrlH:wtzOeRjrRIF2FwYc5ANzEObmNm82lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621284, "uuid": "d15a2416-23d3-49ff-aec5-9a3237782299", "value": 1646456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621284, "uuid": "15252d56-5762-4b93-8368-c3c7dbc4d8c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621284, "uuid": "f71ea32f-681f-420e-b3b8-5c91da624e03", "value": "marine.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eb0cd4-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621244, "uuid": "ec4962e7-a7c2-4d5c-aa78-601978aae52c", "comment": "Malware payload", "value": "fbe92be3e1ed48ceab49e72ecd7fcdd9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621244, "uuid": "40f804e2-e1ad-471a-ac6a-be6627256c5d", "comment": "Malware payload", "value": "d5a84c85508c444743d055be354a464eb22dc5b33cba41e4b149829d182f4dca", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621244, "uuid": "360bdbb9-2eef-4ac3-a179-d419e3c34960", "comment": "Malware payload", "value": "eed499a73ab6c412b4eccd9055885463c8bdd98a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621244, "uuid": "cf68c1d0-716c-41f3-bdd5-4629ef79651a", "comment": "Malware payload", "value": "277c3518d3f57dac6ee8cf0210e0369d45d96e86abb0fc0f182ee0daadbeca078b14da2fd853b40da1049cbd067bf2d2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621244, "uuid": "164f7552-4dd5-4578-a032-46a581d8d3c9", "value": "T159761203F78E492EDDE2B97C099713615619ACEC1910928F4D02F318BEB72D96F26BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621244, "uuid": "cec92dc9-60e7-4fef-96f3-9affbbe672ad", "value": "98304:VmhNsbwLnA/NS8gtiAu+IQNAs2gZmIx3Eg3CBZ/CY88CDP0pKJ11CB8weRK4yBv:whNvnAA8gAmIJzeX0g36Z+NDP0pBxex8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621244, "uuid": "7e1ec539-3c4a-4464-8956-29a988c5defb", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621244, "uuid": "0f41ffa6-2f5c-448c-a6fe-745dc156669e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621244, "uuid": "bd899fe3-c26f-45fd-aee1-b3a26a135210", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db17e697-cea1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585500, "uuid": "1dff7f7d-1312-4ef3-9d35-67fe68e5bef6", "comment": "Malware payload (Mirai)", "value": "827ad49ecce8f191d826fbc30c5bfff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585500, "uuid": "607bdb35-3759-4910-993a-5b43f60cf2ee", "comment": "Malware payload (Mirai)", "value": "d6ad9e1b2f8652752421fe37d651fea1a81b541508205a5582263d25adb980cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585500, "uuid": "9f44adca-a47f-44f9-a6b2-811ffeef53d1", "comment": "Malware payload (Mirai)", "value": "5db8790c61b9916c1b7ba46de683827d6438a53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585500, "uuid": "c0dfc7dd-f428-434e-95dc-367cb02f5a8c", "comment": "Malware payload (Mirai)", "value": "a1ad1212925fc2565735212e024831f7bbb6567419cd9227beb07df06142e738cb0cc4efc8c598f59323ec2989fd58be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585500, "uuid": "6c909966-0f0b-47db-8464-2ca912f2027a", "value": "T1F6B33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585500, "uuid": "ed31a90f-a3c8-4cad-897b-f13a46e3fde2", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1gamwP6Ks/XkmSlx3lJX6s03zxsvAx6VB:eZxMi6xWSam9jSlLJ6iAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585500, "uuid": "0ddf67a9-cf13-4260-9a26-0b37669aa47a", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585500, "uuid": "6c954be1-b030-42de-8f2b-3770b8c53504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585500, "uuid": "80fd0d65-7cb4-49a1-ac36-d5c7d6660b80", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e48b20-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621271, "uuid": "13020d2b-ab73-4bdc-bb5e-f81c038e179d", "comment": "Malware payload", "value": "608819f4c226e822c974f0fdafe13193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621271, "uuid": "08019b64-b69f-4684-abbb-f21378f2bcaa", "comment": "Malware payload", "value": "d7a9a49f61d323d69768737f47983e0820635d61bc96b1b9eda0ae9a92649f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621271, "uuid": "b00e5713-1fb0-46a2-8bb0-beb58fb46a33", "comment": "Malware payload", "value": "9beac254d34e85731a73b74007abc7660d2668e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621271, "uuid": "730fbd68-a7fd-4fbf-b8f2-38a7ed3afec7", "comment": "Malware payload", "value": "3d9d54dbca021d8539785c49dc93feabc4e8944e623924550fd8712992fc631c49470db286e86fbd6583c72af26c9ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621271, "uuid": "6e609ba4-a426-4a21-a5f0-13ecbf01e359", "value": "T1B98533B1F975D94FA992F0DF5390E8AD38693B05AD12793000D2623C255BD327F8B9E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621271, "uuid": "ccf13081-bd90-4870-a890-6df8d67761d4", "value": "49152:nI0gfBeqrmFbQiXEcg8q5krLAeDh2gNRvrt:nI/e4iXEcokrLAc2Qvrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621271, "uuid": "51b8248b-35df-4c0b-8d9d-a98eb539ad6b", "value": 1814440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621271, "uuid": "3e5ab9ae-e29a-41d6-a318-652a1913ca65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621271, "uuid": "ad8d460e-94f8-4799-a5e4-12e326fae599", "value": "gura.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ff5256-ce7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764569570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569570, "uuid": "c8f9d62c-9598-410d-a7c8-25ee1b505127", "comment": "Malware payload (Mirai)", "value": "ef682a0eb32c3c6d57b6d724c7e9b24f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569570, "uuid": "1e09ebcd-44f9-4d50-98a1-3d2909ec871b", "comment": "Malware payload (Mirai)", "value": "d7a9f571bdff74e27230e0643991f34954cdd956103ced8aca9009952f194ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569570, "uuid": "3ceb3a0c-5d6d-4e29-9e8f-0b69fd5b180b", "comment": "Malware payload (Mirai)", "value": "42ca58bdca2c9deb8b658e4a8c2fe2a88cdeb736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764569570, "uuid": "a984d7ec-4178-4ba0-8e52-ea0eb97b4c2a", "comment": "Malware payload (Mirai)", "value": "186f7c8d9f3afc30b0fbe87818835682715001c6abdfbfbce143f9a9180707542f34d4967348fd8c84d1cebf5c1b5b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569570, "uuid": "7febfcd4-739b-462d-b6f7-25e267ac327b", "value": "T1EFA3BF32C82A5D98C18505B8B4E6DE365B23E5C417932EF71AE6C7A65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569570, "uuid": "e0087a24-76c1-4d74-8001-0394aa0ae063", "value": "1536:H/I9A0n3bQK05LKGVwS0TYqcKDFVut7DAQmHICwE6SPXcx:Hw9AkrqLK/TfDDwAQmHIEvvcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764569570, "uuid": "4ca8588b-8fe1-4282-9b7c-5c28f9dcc9ae", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764569570, "uuid": "3c49ffa7-2939-494c-9ad0-1cff74c98fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764569570, "uuid": "89ea2fd2-6f17-4d38-a4bc-be5c0c25a361", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5171c4b8-ce82-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764571955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571955, "uuid": "811152b0-c368-4b5b-829b-c22efdc00914", "comment": "Malware payload (RemcosRAT)", "value": "73143daf27d3dac83ed42785ab4f1993", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571955, "uuid": "6388ebdd-dbdb-40cd-86f4-2b5efca367a8", "comment": "Malware payload (RemcosRAT)", "value": "d80fc0f436dea324b185283251e6dde0fcf7962a6da88af686733ee95c010cac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571955, "uuid": "58252ed7-16ec-4f77-abf3-64f4fbb226c7", "comment": "Malware payload (RemcosRAT)", "value": "e6eb7e7ec1c975511666704c689f95f1e5878e10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571955, "uuid": "6d4d83ce-d7ab-4468-9bec-9117842560fd", "comment": "Malware payload (RemcosRAT)", "value": "7fe69e3293c875b0d168047acff5d43d54918a1e84d6248c194e6d47b6cc22be9518e64b8ed37a22cdc08b906fd875ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571955, "uuid": "7bec41cc-330e-475d-b99d-2cab8d5fb740", "value": "T1DD4503449148B0384B776A03AF400D68AFB428291E4EC07D3D14E8D8CB7BAF861F9DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571955, "uuid": "2bb633ef-28d0-4c07-bcb4-b272addfca36", "value": "24:2xgNiLdz9pkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHQ:rwrZ1NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571955, "uuid": "49d8fcb9-9c99-4575-8d2a-a492f291cf52", "value": 1234477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571955, "uuid": "2eecdbeb-e55b-4106-aa09-4e4d1011e65b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571955, "uuid": "88bb2c72-ca6a-4df1-bbf1-9fda08d22919", "value": "Purchase order 4504033909.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a877f0-ce9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584470, "uuid": "14354153-fe00-401d-82b8-bbfabbc35f25", "comment": "Malware payload (Mirai)", "value": "53deeb27cc6fb60f908be5cad39f9a3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584470, "uuid": "f2557589-a9a4-4863-804a-724f7e92d892", "comment": "Malware payload (Mirai)", "value": "d93eaf1c83df36d8892e04725ac14233f1fe8b0a02fd9b74336563a1bce21022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584470, "uuid": "e879ea93-b85f-4f0f-9d6b-1f1ff1660f26", "comment": "Malware payload (Mirai)", "value": "3caf7a7c467fd4759f23052f0384823f4fdd2c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584470, "uuid": "ed242640-5b39-4387-a1e6-509776560a9b", "comment": "Malware payload (Mirai)", "value": "20c61dea91cff87291831bfcf0b3a5c7ace4005c0aa05855d2cf29481bf84942b54a084eb69cca1030ababcf5026dd44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584470, "uuid": "ed7adb07-e2d1-47cb-8414-af7e83d2956d", "value": "T16123F17C4D69C457C09614782AE343602E755FB392D7AD86EEC0E64F698B7B03A83DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584470, "uuid": "51207c63-96c5-464a-8646-479d566370e8", "value": "768:g+jm/igUe0HCLCO63QTxr4p8d1lMSGfH2SNbT3nGVJmWWHIhjRERfLHo/8mOJgG1:gFigU7M6q4md1lMluSNWnlWRLpDVJu9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584470, "uuid": "779c9b6a-5c93-4904-ad44-0baa3b027fd9", "value": 48624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584470, "uuid": "4a00d05e-c9b2-4c86-92dd-a1e40912a25e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584470, "uuid": "167dd47e-a8fc-4f2d-9485-3b0b2b274b7c", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dda157-cef0-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764619133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619133, "uuid": "7b03deea-90ef-4bf2-832a-fa385fa95d29", "comment": "Malware payload (OffLoader)", "value": "d5540189a9eda67add1d5fdbc010017b", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619133, "uuid": "19baa086-be74-4c5c-a749-4a6ec64810e7", "comment": "Malware payload (OffLoader)", "value": "d9fa4a43701ad20105461cc3525b702faf9416485ca481f42c113bf87a6988dc", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619133, "uuid": "b4bb1de0-3ed0-42c5-b923-b78974222752", "comment": "Malware payload (OffLoader)", "value": "611846899ac6bd1b6fb260856735e75f74a0cc2a", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764619133, "uuid": "738d114b-93b3-47ed-949e-17374d5928fa", "comment": "Malware payload (OffLoader)", "value": "d58b6e568a5ec5d432890259763b8f609fdbc92774823af9756664177682e36d208b6a0928cf76e213ad4a84b61be2d2", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619133, "uuid": "aa63e834-7805-4261-8097-5c3193b9ba71", "value": "T134260237B28A5F3EF06A463F59B292104D3B6E11B41A8C5696E42C4CDF3A0E01E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619133, "uuid": "d147d639-f4de-4858-85a9-7e98a05c0d59", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619133, "uuid": "5589e582-9d0c-4f11-ae92-5728d7ef211d", "value": "98304:HN661aykQ4cFmU8IEzO97F8ME20fSjbixu9eCzvmsRS+QSOEAN3v5IE:/0ykeFa7zO9uZ20Oio9acS+QTPN3iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764619133, "uuid": "5a828aa6-4b7c-440a-a251-4d5dc8731c33", "value": 4565323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764619133, "uuid": "b16a5d92-6493-41bb-a8c8-db1c3349ddc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764619133, "uuid": "a3f63642-c639-4da0-b84a-3c30b9d0b22e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7843924c-cef2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620124, "uuid": "ee5e8f35-2bf5-4db7-9e05-de5d02318ad3", "comment": "Malware payload", "value": "bc64ff65a35f930065cbc64106b68beb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620124, "uuid": "3b0c4c89-5047-41b5-abcd-133981f9fdc0", "comment": "Malware payload", "value": "daa85eb29b4eb5b5e084727233f9e16750b18717337805bba4cbadc74b5a1cc0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620124, "uuid": "009b648f-a2af-468f-849a-43e1dacf3f9f", "comment": "Malware payload", "value": "4eb0fcf9e2df94b9c72f87077d52b53a768a14f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620124, "uuid": "691cce76-8661-44ec-b544-828fd201f82d", "comment": "Malware payload", "value": "a28bcb8557a2a2da9169e5d95971dd4d9f7fcc974e393e50258c6afa1416b69e2369762db7381fcbcaf244031581caca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620124, "uuid": "7956a45e-18ee-4c79-b982-44998ab4abe5", "value": "T1C4B45BA2639627FCC1A2C3748005362CF6A13F65562886D7529AF7210F37A8C6F3EF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620124, "uuid": "ebf2c308-ef12-4e44-9b9a-6ff7351006ee", "value": "7f972135e4ef2afd8f6b7ede6e0f3f09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620124, "uuid": "b5a4a00a-8138-4f2a-bce7-e3659677b242", "value": "6144:WJMkSGaPY8NbAsPwDmXU+SIRWpci843tIbRBZYDWkm4dRBCOysTf1:7kSVw8FARmlX+gjIdRwOysT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620124, "uuid": "03bf686c-262f-400d-8535-54ca164d4abd", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620124, "uuid": "ebb901b1-a28f-4262-9ed4-bafd45b924dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620124, "uuid": "72a64320-7d08-47a5-bfab-b2f34f8951e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bcc3b2-cec4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764600420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600420, "uuid": "bfc32081-4852-4b95-9f3f-7efb144626e8", "comment": "Malware payload (Vidar)", "value": "e23a525858f0e16bdb90820944225348", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vid.file", "colour": "#466FF1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600420, "uuid": "c0accf47-dc79-49c1-8401-4eb8cbec902c", "comment": "Malware payload (Vidar)", "value": "db049aa31d16858fe9f20f5480fadc14f1e6d085da70e52464d235b0ee54504e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vid.file", "colour": "#466FF1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600420, "uuid": "d250ee8e-ad47-4aba-b3b5-8907ff17e6b3", "comment": "Malware payload (Vidar)", "value": "3245d6eca0503a91501e36eaa9630af0a2d6390a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vid.file", "colour": "#466FF1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764600420, "uuid": "d5ab8bb4-5cdd-48ac-9f0c-121b8d74abe9", "comment": "Malware payload (Vidar)", "value": "cdf3beefab16ed5d3c9bfc80aa121d08a4a8106d06e6571cfc12b35da0d69aa82835b2ddae1039fc92cef4a6c591e369", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vid.file", "colour": "#466FF1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600420, "uuid": "4246a3cf-01c7-4153-a376-75ce0beb52b6", "value": "T1D0464A02B850F6A4C1FDF238A4D0D193A621FC68473137DB2B6279720D767D45AFA7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600420, "uuid": "562b3095-df95-486f-bdb6-1af40cfdfc45", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600420, "uuid": "dbb90a85-b5c4-4dd3-a493-176448d2dc1f", "value": "49152:Lst6JpHbiR0xash37tJACz7KBqRP7X6kb2FO9ZJOJPtm2Bf1Ej+wBexFkX9g+Mah:5bJH2k9ZQJ4efmjBIXs8aln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764600420, "uuid": "ad2e3f98-ec2e-45ec-ab88-edf2610543e5", "value": 5460696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764600420, "uuid": "80b18285-cafe-4fa7-aa89-66187dfbd8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764600420, "uuid": "a98c48e1-d1b9-44c2-b3aa-b4b3b4dae434", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755aee8f-cec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764598644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598644, "uuid": "51f26869-1ab3-4e25-9981-4241bde4f089", "comment": "Malware payload", "value": "56820f94fcc9acd9d1621bdb1f509144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598644, "uuid": "d8b59d97-138c-4e5e-8fe0-8a0383d9550a", "comment": "Malware payload", "value": "db21d3e922011fb160cf1cecad57529406bbdadc6299da9255d0083df2e7706c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598644, "uuid": "49b72cca-bcaf-4aa8-8795-8ca5f000edd8", "comment": "Malware payload", "value": "cc2b1d3b2580083a989819db1dedd1cadfa7b78f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598644, "uuid": "487a76ec-46b7-40c3-be83-f22224fd89e7", "comment": "Malware payload", "value": "1117e90744eddc008054e38e8a84a9172e7f09a1ec55df17fa4b997ccb58bc00728d4175989c7030ba372f968781388e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598644, "uuid": "a2ba3dfe-5bfb-4a0e-b486-7d93940de33f", "value": "T187051B7E5963912AD94A80FC25554B6249B1B33B03F40FF310AA91312717AB2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598644, "uuid": "3c130002-3ff9-429e-8b3f-b0890b1396de", "value": "24576:bZGvihh58LPufbTBO9PdRNgDXz4Ca8iQZUqwt2f:bya38L1Xn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598644, "uuid": "285295f0-d978-449d-8fb3-877f4fab6cd4", "value": 834608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598644, "uuid": "2bd15d04-9472-4caa-b46b-766dc694e9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598644, "uuid": "8d457250-54ee-4657-8b03-191fb6907396", "value": "license.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628061bd-cf03-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764627389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627389, "uuid": "9cfb71ad-3e80-49d5-9f61-3895fe70c267", "comment": "Malware payload (Formbook)", "value": "b4fd65e6e620e86de4d38cd24d0599b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627389, "uuid": "2642842a-aa04-4da9-8a1f-4ed61fcc60ae", "comment": "Malware payload (Formbook)", "value": "db603d2938218ca0b95c604a319858d625907401a9317fafce65d916c7858347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627389, "uuid": "865b4af4-69f1-40de-a7be-cc31566279c9", "comment": "Malware payload (Formbook)", "value": "8ef0a3c02af5c10b68bc922984e6ce80e33a962f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764627389, "uuid": "62daf9b1-c105-4acd-abc6-6fec5f34228d", "comment": "Malware payload (Formbook)", "value": "eccd11dfe39a8f99c34a8effb16c0b5a6f60cb735d4b150e732431737002c4952fa661607fa582e894c882f4c9fbd5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627389, "uuid": "5fe6c849-d563-4517-813f-ffba86813c54", "value": "T1E4E401578E9CDB43F8A017F62D33DA781B652E0DA021E3DF06EA4CDF79157211C8826A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627389, "uuid": "b7ef50d4-3791-4dd6-b21b-685cdc927c6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627389, "uuid": "b4941a92-9e9a-4771-bca1-cf62044219a7", "value": "12288:59xHCIB7Fk7fhQO7f1PHmJ946BE1c+bQ2O7KHluntsk:5DCWwf9f1eXBE1Pbi7Nnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764627389, "uuid": "0739f497-ce17-4c01-a66a-6df9573a70fd", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764627389, "uuid": "e97a09e7-78df-4ada-8b41-a13fb1dfe812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764627389, "uuid": "135aa464-ae83-4e81-99ed-027e663ddd6a", "value": "mwZXMc6QhO81beF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d9ade-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764584152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584152, "uuid": "304f0f8c-fff3-4b7f-94d5-2f0524528950", "comment": "Malware payload (Socks5Systemz)", "value": "b1e18ae12e6a9d1011db3fe1c3a80c9f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584152, "uuid": "0b32941b-e4d4-4308-b04d-762fa20701b5", "comment": "Malware payload (Socks5Systemz)", "value": "db6ec2ff10b737cda4ef8b8787b12239708a45a3f18e8336fdbf45662b6669e5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584152, "uuid": "a91ad339-c000-4f73-a76d-e7509bd41fd7", "comment": "Malware payload (Socks5Systemz)", "value": "ef30d60809cc31a13d2a97d861b5b266b47ee352", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584152, "uuid": "d0a0c19a-136b-47cc-b078-658ae4d960b4", "comment": "Malware payload (Socks5Systemz)", "value": "93f5e7ff85ce3fc046768dc6a0de616cee58beff75e7b8498a78e20d0ab37d7a888d20a6dc973727c2454515b1f8d7df", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584152, "uuid": "55b7d718-fa2b-49b0-8d5e-bcd07790375a", "value": "T1B4F533C3627788B0D405DD344CC9C5B42337B9FA056A9490639D9CBF07AB2636A16F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584152, "uuid": "7ed09ff4-c88c-4ffd-8434-031aed7e6b1d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584152, "uuid": "dda9a9b4-07e1-4005-8dd2-e092567bea1a", "value": "98304:MOIa+JTBhsh/3w5oCK8iWheonF33EV7fkF6P895t+sM:jTyT3sh/g5oCVZfnFo7QblM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584152, "uuid": "24a85476-6131-4949-9152-c83fccb095c3", "value": 3324318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584152, "uuid": "aa852bb8-fdeb-4fa3-a390-92df298b66d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584152, "uuid": "57c66fa6-3a2f-4a3e-9a61-14103d1cf11a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9091a0-ceb0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764591595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591595, "uuid": "0f26f7ff-7923-4036-a829-ee7da83bb20c", "comment": "Malware payload (Mirai)", "value": "72ae461b99008d4a1db0bddd6078e820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591595, "uuid": "abf38f0e-ac11-4f81-b770-f69768933ebb", "comment": "Malware payload (Mirai)", "value": "dbc8fb59d9134a0f27c97fbbf03fa0cf805928eec01712db973ef5463ffc055d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591595, "uuid": "673dae70-c493-4603-b881-c905ff54bd1f", "comment": "Malware payload (Mirai)", "value": "946e9180d5115792bfe138d4173c1e22d5752ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764591595, "uuid": "3e77cc8c-3b91-4c16-92e4-fb54c97334cc", "comment": "Malware payload (Mirai)", "value": "6921861e72a3c1a86d0512a2e91a65720c00f188611c9ceccfee8c400bbf104cfd334a4d3b9399c83d04706d6bfee6b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591595, "uuid": "76fdefbd-0cbb-48d6-8e73-873c8e9c8736", "value": "T175557C06BF549FABC1ACCE724CABC31701BDD6830682561A72BCC76CFE597584E83694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591595, "uuid": "57da8d0b-ded2-48ab-8568-8c110e35b462", "value": "24576:Dh0mpZhRF7+/lhKcrdLo4HLrb6b95TkKTGI81zUC0j:Dh0U6H3dEULCbLTkK581zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764591595, "uuid": "1a6b2535-ecf4-4b4b-9007-bef8bae072ac", "value": 1382932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764591595, "uuid": "4996f5aa-9f15-4e06-bd5b-cf24e87f19e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764591595, "uuid": "a1e8216f-3020-4a24-bfcf-630def3d1387", "value": "lava.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ba81fe-ceab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764589808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589808, "uuid": "ec4dd2d6-8e41-42aa-8b98-2233fc24b821", "comment": "Malware payload (Mirai)", "value": "c2f82c8040b21d07133c578a9472c8ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589808, "uuid": "45173a16-c1c2-4c5a-bd8d-84a0872f9093", "comment": "Malware payload (Mirai)", "value": "dc2b16dd3568910e268d925ce52a790e440e0a7b6c9deee8cc5c644bf3784855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589808, "uuid": "3d5cf82d-b45a-4923-a5bf-769ea6417b27", "comment": "Malware payload (Mirai)", "value": "de1544a975c20c1b3b2b4e24b978534a07d2c3be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764589808, "uuid": "e4f5a559-792f-48e5-97e1-fe3468fbbcba", "comment": "Malware payload (Mirai)", "value": "4870684e7fcaf36d9bd8ab2444d9789d204f7953cd0ea9efcb4bcded62a29c9c11363504d636c50ebac3f5154f716426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589808, "uuid": "5a28b566-91db-46aa-ade3-0c8853f1456d", "value": "T176144B55FC81AE12C2D05777FB1E428C33262759E3EF7907DE144F2527EAA9A0E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589808, "uuid": "073743c0-27d0-4640-acc8-88a545be0aec", "value": "3072:nHkW9ydtCH9eMJSfo3FlxYcG0hSq9Jj8Sf1qIEy88+I42+ruVyvIsVoXyl6xiy:Eey2TLYSf1HmpI426uV5siXyl6xiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764589808, "uuid": "0cf1039f-fb86-456f-b2f7-9553ad427ee5", "value": 194824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764589808, "uuid": "33029cdd-ef78-475f-a0f0-b22e1367de62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764589808, "uuid": "1e303849-5c1e-4b9a-9e20-ecd5bd55d181", "value": "lava.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1684163-ce74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764566211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566211, "uuid": "ae700cd5-89bf-4b0d-adb3-6b7de995313a", "comment": "Malware payload (Mirai)", "value": "048562be8195f1874215815fde46ad6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566211, "uuid": "725e0a6f-7ea1-429f-a455-29386b737053", "comment": "Malware payload (Mirai)", "value": "e03f412b50068bb85229e94bd2193abf7f79e77222dde0c1d9262e31f591aaae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566211, "uuid": "e88daed5-71ef-476a-a208-ffc2ce727b68", "comment": "Malware payload (Mirai)", "value": "734361e0177cacff9beaf667921f585b518e35aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566211, "uuid": "4ba7be5c-a11d-45b6-b7a7-5d0fd51da1f6", "comment": "Malware payload (Mirai)", "value": "04d721f276aceac9460f2c44990bc041766c0248daac1e0371391dc03a20d46aacc0996cf971d1765c6a3cbd496be8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566211, "uuid": "bbc8cf44-9664-4419-8786-5c37fba74eaa", "value": "T192E33B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566211, "uuid": "c6acfea2-c90b-4f65-bddc-bad619bddb56", "value": "3072:2+bOKXEZgv+TpdkDD4D6Ie1k6aUfzL6EiueCo24t:5OKcgv+TpiDDceS6aGIuec4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764566211, "uuid": "b136c415-d89f-4533-b9d9-ee83017e1c25", "value": 145584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764566211, "uuid": "27ecf455-3d92-4b45-94df-8a975e47a9ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566211, "uuid": "bb838baa-c73e-4811-9357-6f8c0e666f0b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cb8efd-ce7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764570328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570328, "uuid": "30b10e2d-c492-44fd-a26f-a9dd2c228f79", "comment": "Malware payload (Mirai)", "value": "86c323e662a4fbe8bb4e54bf55231a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570328, "uuid": "c6c89614-f426-4561-ae6c-020b47a00688", "comment": "Malware payload (Mirai)", "value": "e10f4c547087f4264ed32c2ebacf6dfbedf2cb593c2fb8feec98a8d2a9337e11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570328, "uuid": "95981616-2e2a-4128-bbea-1776b52669cb", "comment": "Malware payload (Mirai)", "value": "aaab3745f09813d5b318706d395fd7cd12c36a8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570328, "uuid": "285a3d7d-aca5-4daf-8634-d1d3f20f6c67", "comment": "Malware payload (Mirai)", "value": "04c57782ade281e3518a9b0e9c7599aac579af8870343ccebdc1c729fe49b2fe2ac79179bc6c0f92650c869df0a989ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570328, "uuid": "e4a5ad15-2af7-4522-aaf4-6edd1a4d00db", "value": "T10EB339C0F98B81F6C40B8C306166F63FDE31D9A94171DAADEF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570328, "uuid": "94b23296-2933-44b6-bffa-81ed6986b0ea", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJUTMUfnDHGKgpuzFlo1OEc:q/ij6i8CsMTMXi9KcQ8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764570328, "uuid": "1b5c92dc-fbf1-48e7-be9b-2f853d751434", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764570328, "uuid": "24547d3d-38cd-43e4-b29c-5b04501d5189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570328, "uuid": "a4dc45b2-aeab-4cb4-97f5-62ace10e88af", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d4df87-ce9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583451, "uuid": "23d7a60d-36eb-4f8b-9367-e8b1f12469e3", "comment": "Malware payload (Mirai)", "value": "906fc2835389e649993a6f47048130d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583451, "uuid": "4049b725-65a2-4fa7-a365-6dacbe90e3be", "comment": "Malware payload (Mirai)", "value": "e349b4e01c1d4eb80f7ccab59b59624eda0b5dd929e976e42a918a7b8dd736e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583451, "uuid": "54fa800e-6bd4-4dfa-b922-ead6bb89cdbe", "comment": "Malware payload (Mirai)", "value": "d8e796afe9634f02c02d47740dac7bbadfc7cbc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583451, "uuid": "7a5aa563-c594-46c2-bc9d-1894c5cfbadd", "comment": "Malware payload (Mirai)", "value": "338fa79ac1947ee933f1335a57ebe624d65d2540a65564204f13aaeedd8ea78ca6586f864fcf7a346223ebaa1c4f78e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583451, "uuid": "dabd7809-54bf-488c-bbdc-3bf720f68a8e", "value": "T1B86302A87972CF14FD524D338DFC29C9D00F2663153A8979F60B5A2D54E63EC76038AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583451, "uuid": "25beefc3-7165-43bb-82bb-a33b79797652", "value": "1536:Bc/Wg1HEiJuN5Af+T6yvYy+EBy3SiHCCTNZQP3ol16orM:Gjy+uXAfyvpI3THZo/QESM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583451, "uuid": "e7d50cb1-ef20-4cd2-b5d6-d425c2c41efd", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583451, "uuid": "5472c4b6-d9c9-42a8-abb7-7f2ba5dfa86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583451, "uuid": "3ad24437-a390-4876-ad05-4243fd287c30", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd81ddff-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608751, "uuid": "19ddd196-b498-4539-946e-621971cb21cb", "comment": "Malware payload (Mirai)", "value": "ba6556232f95dccc472f5317c4d1f1f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608751, "uuid": "cee1515e-ec69-4180-bb22-ee0463a9ac4b", "comment": "Malware payload (Mirai)", "value": "e3f40d88a821ae508351ebc237e1b9a36a4da6b63719ec267cd67b34e1e1ae80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608751, "uuid": "fe8d5754-f1b9-4fd8-bc68-8099bf685778", "comment": "Malware payload (Mirai)", "value": "c8a88c35fccc2732a870a2da2e913cc4069921a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608751, "uuid": "47779ee7-e757-4d26-9a0e-018e09915b79", "comment": "Malware payload (Mirai)", "value": "9913d95da600d0fbc758e6e865941af57da794d97fe3396ff0df743e4ebfadc4e6e84b5ad8ac8db9218e1530287cde96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608751, "uuid": "f253bcd2-8248-404d-9532-5694a8bd73f8", "value": "T16D630A5AB9819B15D5C112BAFE0F128E7313176CE3DEB3139E24AB20778B56B0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608751, "uuid": "a80c4a2e-15d6-4d0a-818b-78ab5e4978c2", "value": "1536:dAnCOUC+FFakFfah2F5+2yMviCIUo0inoI5+YUzVv:e+mifaoxIUo0inoIkhzVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608751, "uuid": "3735eb90-6719-45ad-ba17-930feaac1f40", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608751, "uuid": "17c8eaff-b4bd-4f80-8add-8e5382d9bbfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608751, "uuid": "e1e549ea-cc36-4247-b5f5-eace53845424", "value": "niggah.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abeed2c-cefd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764624906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624906, "uuid": "55d1f48e-bf7c-4198-b165-59f7ad7106c0", "comment": "Malware payload", "value": "5dff63158952ef05d46a3eabcf22e52c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624906, "uuid": "74f01b21-0b8a-46c7-9e14-d8a0dd2cbb6f", "comment": "Malware payload", "value": "e46df5e79880777c4a01ab370bb6f4f3d8d51c57ac0dfdbb9c7370199f363508", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624906, "uuid": "4eab38dc-dd42-4ea3-8bf6-a71a9e0173ef", "comment": "Malware payload", "value": "046a138cbcc2576a10fcf7639131c97fd5b3eb0e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624906, "uuid": "90e24b47-865c-44dc-b39d-1aac8f6b81e5", "comment": "Malware payload", "value": "dd6abccdaa87406940e54e35f362e3b076f29dfd637491f784b373eef107134562cfd281eb5677d6c375e0fd718272a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624906, "uuid": "dcc6e80d-03ec-4c15-95d1-4f5dbb7f0d93", "value": "T1D7253399A514A00FE2D71E7CCCAE26BCA36D9C15DB581052BBD3B2FFBD73A0053905A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624906, "uuid": "ab52b1fa-8395-47a3-8d65-dd8a012244bb", "value": "24576:8i2igWQ/sxILKiBGnkdy/vLR08iLF1QlTIrSLD6Kg:Z2BzLK/8ynF0PF1lo6Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624906, "uuid": "b956db55-ffc5-47f4-85d3-62ac5aedba9e", "value": 1041156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624906, "uuid": "fcc5f921-e53e-4376-b94a-d5939103c20d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624906, "uuid": "986bc1b1-bb1d-4067-b258-463fa1d422a3", "value": "SCAN_BC_TH_1389.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b361b47-ce89-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764574871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574871, "uuid": "2a3fe667-3875-41f0-88b4-7254ef3bd696", "comment": "Malware payload", "value": "bd99e51d96da9254ea074e8529776a10", "object_relation": "md5", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574871, "uuid": "33090ccf-48fc-466c-bf03-74f25c381395", "comment": "Malware payload", "value": "e4b21123c6a2087528933a86376901509bd7b4db273c3664b7993647aac58543", "object_relation": "sha256", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574871, "uuid": "300c4edc-51d9-48e4-bfb1-4e25343a97db", "comment": "Malware payload", "value": "1c17f35d468d106bbc8846bfd5ac27cd927c0b69", "object_relation": "sha1", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574871, "uuid": "137aebff-21bd-40f7-9bb9-6cf8b7b3c173", "comment": "Malware payload", "value": "703391a48f03e6a5e51edb8b9b9dcac9632a68d29f7a853214bf95c4327fdc283228ffcdf836c7717a4f76381038f544", "object_relation": "sha3-384", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574871, "uuid": "90b5ff78-6cc4-441c-b274-f4dda681fb1e", "value": "T121E1CA4069124A8C613384A79DADED14E02503A3DD5B0D24B98C88F79F70F9FDA659FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574871, "uuid": "5f6b2e7a-a9cd-4090-bf3f-01c878dd5c90", "value": "48:t42yJjTL4JHapY7Kc8qcQXB2zOob0Qz7yk7yk28KX8/el/UzXFUZ8u0DNDDZmpze:qVvrYcQR2zOoI1X7/Uzxu0hXZQ2cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764574871, "uuid": "f9d4b802-eb4d-4e03-9b90-03b8b5181c16", "value": 6912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764574871, "uuid": "15bc50d9-2568-4ad4-96d2-b525aa8eefc8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574871, "uuid": "3dc6f208-f8d3-437d-8616-e6a2536d8f72", "value": "do.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafb000f-ce48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764547329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547329, "uuid": "0198b9dd-ad5a-4a00-a93e-288c2d24eaed", "comment": "Malware payload (Mirai)", "value": "210f988bcc06b8556e226714d173f2ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547329, "uuid": "0c740d0e-5776-480c-8a84-e73b99111b64", "comment": "Malware payload (Mirai)", "value": "e5120e9f270e2519f909f1684bb0f7f0c90a66425c0b3e5f2feb2204b189cc56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547329, "uuid": "2a20940e-4093-4546-946e-0910498a4f96", "comment": "Malware payload (Mirai)", "value": "963a475b07bd54f0f15cbbbeb808198e656bdfad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764547329, "uuid": "8801db1d-87b5-4e40-b793-1b7c6dd01cb6", "comment": "Malware payload (Mirai)", "value": "abcbf749f78f84b5ed750cfc54128411094b124e3f7dc4556266cdbdbba36d6d2636220c8e87c2241663919185b59aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547329, "uuid": "974857cb-e25a-4fef-a688-c4fe66762173", "value": "T1B233F09D51A2F881D47E4CBDE68E03E5394290ED31DE0B58CBE40869DB7DA2D398D0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547329, "uuid": "61affc02-37cb-4f7c-99d7-df69e7a6fc1e", "value": "768:+zzEd+Vv/VJ6HAzHfnRaBkrAE50FLTTRyZX4kdx2g0f5nHkHqnZBw54bJjP+W/:+/EdWX6aHpaBWKFLXWN2gWXw5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764547329, "uuid": "f4a9715a-f128-4a01-8b03-198053adc01f", "value": 50512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764547329, "uuid": "78cc4bc3-e050-46af-b78c-3df3cec7a2c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764547329, "uuid": "ba0e09de-e106-4efc-a5f0-8b1b606b8428", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdaf391-ceda-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764609641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609641, "uuid": "97e69223-a63f-4b20-82d4-47ef04091f5f", "comment": "Malware payload (PureLogsStealer)", "value": "d2da50a1eec2697d89cfaef88a049ad5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609641, "uuid": "a3f455d9-8cd7-4a7a-99cf-f69dc041428a", "comment": "Malware payload (PureLogsStealer)", "value": "e548e4d662498e099d9e3a6dc60bd99d3ac615411d0a8e716e75edee6f8d62bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609641, "uuid": "2591505b-f55f-40a8-8424-fb29a29dfe62", "comment": "Malware payload (PureLogsStealer)", "value": "d48c88a933f7a4b1571ea8e141112e2d25e2765f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764609641, "uuid": "20e37a9e-4216-4d10-a16c-197b6042e453", "comment": "Malware payload (PureLogsStealer)", "value": "5931bf1a3150756b808f7009ad90e00ddaeb341e9ad221c5a34057b41fedd6ad0317043ac193a274163479879d1892b8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609641, "uuid": "d5b966b1-3cd6-444d-998d-19ae6f8a321a", "value": "T1C7C423826F3CC332EEA29A7BE5E75A0806A5F9D00173D51A3B4E27441FAF7D8C711246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609641, "uuid": "2e77eb60-3400-4ec6-a217-2bd6e3512762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609641, "uuid": "587c923e-e7b9-4224-8248-13dd70250a56", "value": "12288:MGdykdT6FrGI2Vmi4vsJU1hovKlIWYwrrubAMXmkr:9dyGuegUAhlxv+AMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764609641, "uuid": "6c9d823c-a260-499f-9dd0-0c27f534c6e8", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764609641, "uuid": "79a2fd2b-b17e-4ce4-9b95-f1e4f4218fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764609641, "uuid": "ec1c1470-c336-4320-bbd0-532b8d292330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d9a927-cea0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764584842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584842, "uuid": "8c83797f-d4af-43f3-bcf5-df19ece690ed", "comment": "Malware payload (Mirai)", "value": "58c8d5677f808433e59d78494daba5b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584842, "uuid": "62946bd2-36ba-4deb-8312-c99a2f22e695", "comment": "Malware payload (Mirai)", "value": "e5d5d15fc56d20938c142ba1d146ff218676cf210b26ae60c33626d806aa1993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584842, "uuid": "d412b15a-241d-48f0-ade4-9e7709cd5889", "comment": "Malware payload (Mirai)", "value": "b64e907fa5ad5f1e12e168dcab2b9d961c97a10a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584842, "uuid": "03643d60-1431-47e6-a3c0-5d17660179b2", "comment": "Malware payload (Mirai)", "value": "ff0d62c6b5a513897e6c9d5e3b196b6533ed72b38cccd79a07e0ca3cd7557ea75c67a90f49f5cbfa10cbc483f4dda7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584842, "uuid": "3cf30807-5826-455c-bfff-78317a7a2bfc", "value": "T1276302DAAFF82792C17CA3B236447B81D54674E1AC53EB5D3E0F01062E6860F74D9786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584842, "uuid": "715b717f-decc-4502-8735-48621cc9f519", "value": "1536:YPJPnvrvXgx8M1mtZv6vLux6C3CWIS2n/IkJrwHuaycnuKDN0:YFnTvQ8M6vLx6CSWItn/IkJkycuON0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584842, "uuid": "59951e09-8132-4bd3-8d0d-26b05c4ca740", "value": 68568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584842, "uuid": "77526724-e013-4cc5-b0ae-529ae8488a38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584842, "uuid": "97dda7de-cf13-4588-aeb9-e95c8a187556", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720dc632-ce7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764570292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570292, "uuid": "7b29592d-f233-40b5-9918-04d70e205854", "comment": "Malware payload (Mirai)", "value": "3055eede369aedffd720c6ff5f2e72fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570292, "uuid": "be0bb218-9365-4dc7-aa3c-50c676a32e70", "comment": "Malware payload (Mirai)", "value": "e5edbd4df964daf6c9a25b276ad8e30eebda9df9856b2b2f6f2376449e1d0de1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570292, "uuid": "ff7433ea-dcc1-4bd0-bc38-73080d7f7f6a", "comment": "Malware payload (Mirai)", "value": "03704c2a5afce15396a89c14494f1cf86aa7ef59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764570292, "uuid": "21332751-1de6-4e85-9c41-02d719267555", "comment": "Malware payload (Mirai)", "value": "3426d88feb7d78ccb06afbf26e5186708c14530fd40526b71ef2d1371efddedd735f2d1dceab969a9ad4ae8f508023bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570292, "uuid": "027637fe-b770-44a7-9520-a8a24ec97317", "value": "T1A5D2E1162646BC92E3209973DEBE99CB25CC77B8C7FB544A21441E39EC0E11EE9FC112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570292, "uuid": "ba96ca2b-c2c8-4e94-a971-7570cef04511", "value": "768:wSqEkxgmuaN5QRrY3XprGsQK069l4r35Vs3Uoz+aF:wS1CuaQRrYH8B5YzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764570292, "uuid": "ead0d27d-968a-41bd-b3fa-27eafb8ab037", "value": 30976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764570292, "uuid": "d8c43838-07cb-4b87-a633-c90cae6569b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764570292, "uuid": "91cca5cb-faba-48af-a323-6b36a8e128a8", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d152c5-cece-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764604811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604811, "uuid": "e9394725-8e35-4f76-bc51-eafc9da23f6d", "comment": "Malware payload (RemcosRAT)", "value": "a83af3ab09556c0b862bbf13ed023207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604811, "uuid": "350d56ce-d10f-41cd-b211-b561ddda4766", "comment": "Malware payload (RemcosRAT)", "value": "e710b54964053441596c34b3d478d6784b314ffd8bacec9def124050b2a86f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604811, "uuid": "e63cbd7f-6a34-42db-98da-6e3607e9d7c4", "comment": "Malware payload (RemcosRAT)", "value": "4402e0971369d9d818b08656c4e4628a6677772f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764604811, "uuid": "a4faa0a8-8fdf-49d4-8b4d-1a28698df1d3", "comment": "Malware payload (RemcosRAT)", "value": "5fc5e1e0249c5538f64e429606c29e7b27510ade1fa33afeadc08cf66121826d47a57671a343364d74ff43cb18e0b3e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604811, "uuid": "74435962-ab0d-429f-a9cc-ec6536bd341d", "value": "T1AA3512230AA9DB07F49623FA5C32CA741B7A2F5DE051E79F0AE74DDB79607104DC8229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604811, "uuid": "9f5f30c4-f5b5-406d-80b5-e4b3cd0a0338", "value": "24576:CDClCePmSVy7+zkw9o9Ao/NlWYVqqp2uY0dtosNw5g6B:CACeVVA+z9C9jlWQFvosKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764604811, "uuid": "735899f0-47ba-42e2-a372-bd50127d6c8e", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764604811, "uuid": "78b2364c-f225-45a3-8e90-a6c3b9bfc5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764604811, "uuid": "27c5056f-f6fc-4a52-b4df-30b46dbea275", "value": "Q1TOURZStKiEdc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e629020a-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764608712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608712, "uuid": "f9db7d42-681e-4d82-9ba7-0cae4cf28d4f", "comment": "Malware payload", "value": "2ce82b46c86d0ea039019bb2c2872d2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608712, "uuid": "d1a2656e-53c8-4d17-8801-56382a110368", "comment": "Malware payload", "value": "e983a0b8978d0872e795ca9efda0fecbaf465e5b318323708328bf9a1fc87a4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608712, "uuid": "5d455524-a63b-4e43-86ca-23846ff212db", "comment": "Malware payload", "value": "18f95516f978e1f83fa73b6b3755f144bb11d7fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608712, "uuid": "79837dd6-58ea-4c50-ab96-a93066fcb5dd", "comment": "Malware payload", "value": "1b83f15c1ad4146b1da27c035050a938671352cf7001b91f722f00621fe4e84f41751607c69460a8415da3a2964f9fb5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608712, "uuid": "bba7cf89-a00d-4abb-a05c-43f72e5721f9", "value": "T1015107DA4B310533AC099C6571BB111A7880AED714CADFE298D435EBD0ECD60A5BB7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608712, "uuid": "f9e18319-97c6-4c30-9a7e-a271dc89b4cd", "value": "24:wKk6lSKX9GKoRoNIeoKVzWKoK/4/GXx6Kiei0qiwK+R+H4KDhkKmcl8K+Uj8KtG9:wI8IGqoIWPSETH0qiwJIH4okY8Mo8jrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608712, "uuid": "5d1c4f7b-beaf-4425-b868-234d88fdf9dc", "value": 2520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608712, "uuid": "fcd7cde6-3f22-4edf-85bb-376e51700cb5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608712, "uuid": "9ad9f65b-53a2-4481-8507-e5cd11656d24", "value": "bootyfuck.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf473c1-ce71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764564886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564886, "uuid": "c14e9f82-7c12-4f37-8dcd-c66beaacc7e9", "comment": "Malware payload (Mirai)", "value": "704aeba6cae87f1cdd71c8653dd3e3e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564886, "uuid": "3b816e6a-c2d0-42a6-8b59-fdb992aa654c", "comment": "Malware payload (Mirai)", "value": "e9a1cb2b8cf0c4a1eb4948e6a336fc2a56257c4a65fa00a28ed50c98b02cfa74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564886, "uuid": "19944349-a98a-4b18-a94c-0196b35df477", "comment": "Malware payload (Mirai)", "value": "7a31c11cc207a6eb514a714c394eba8872d9b9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764564886, "uuid": "10fcc6b6-6692-4d66-971c-cfd9d69f99ef", "comment": "Malware payload (Mirai)", "value": "0e4b7df3260cbf8e27b5ee3038c89dc60d6f1f69e99e46d148005ea2d419f66a51ff76c7c7d62b9cf7e883a31e4f5ff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564886, "uuid": "a90a32af-a47f-4690-9d09-cc7612b185e2", "value": "T1CAC33BDAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564886, "uuid": "15fcd2de-3ac1-4302-b97e-f922501cb9de", "value": "1536:OVI1MQBlUwbswLQ657zSwISXqZdkZgxJsdtHWYpL3fPu8lgxFkGOEVK5Kx5vjLvo:O7wLf5ESckSE2sL3XunXVhxNAp47Zt6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764564886, "uuid": "49b50c59-6fc4-4098-b965-28d6323a1c77", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764564886, "uuid": "38df0514-a1d4-40a2-8d5d-65488a37f3c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764564886, "uuid": "f726f4e9-f7c1-4d7e-8b6f-ea04fe1abad4", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6ae26c-cefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764624079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624079, "uuid": "140a80c5-ba34-492e-b6ce-68213abd987a", "comment": "Malware payload", "value": "30f939f801d2e500d058ff0b23ce1e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624079, "uuid": "96a82217-70aa-430b-9941-ed30e4010aa1", "comment": "Malware payload", "value": "ea0ea05e7f4bf29046d187a30cca474a3000004782ba434838cd7113be6936fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624079, "uuid": "bb18db76-27f5-4794-a477-ee48b73d8df2", "comment": "Malware payload", "value": "c7c8faeed100fd2b3044dfcb9782f42bd5fbaff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764624079, "uuid": "9e2a8bec-b941-4371-8488-e68c09068957", "comment": "Malware payload", "value": "45681391c993fd4de150f409f073e85a7d0f5ecf290888d10b2125a034ab9335cb178de324c021b819d996c01aef923c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624079, "uuid": "d78e6443-a524-4e95-82d9-c6d74e1eb0bb", "value": "T10D755B233B21CF6AE355D63005F3CA515AE620A31BF1449AA26CD72C7E50B59285FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624079, "uuid": "25f7fabe-b6cd-4b8f-a088-022666d58da2", "value": "49152:a9HM8Vpb+wI+b+VtM3zI484P20zMgfWMV:oBb8A5PWMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764624079, "uuid": "f3f2d25c-c753-4705-937a-b1ca87159867", "value": 1669244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764624079, "uuid": "1bf785a2-f885-44f6-aabf-a40e40315825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764624079, "uuid": "a39a2e2b-0cc7-4af2-af6d-2fe37abb7262", "value": "exploit_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75159883-cf05-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764628279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628279, "uuid": "a15928ac-9776-4aed-b1be-35f0e19093de", "comment": "Malware payload (Mirai)", "value": "7f6871f1ce987ebd28430f764d31a807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628279, "uuid": "3d8c69ce-9d0f-4ade-87c9-64eecce5ebcb", "comment": "Malware payload (Mirai)", "value": "ea97a3ae1538ab61c40e67e415e31cdce2094e97bcc8bd497cd82b511af61581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628279, "uuid": "d98fa40f-36a1-403e-b6bf-15e56a8eb0c8", "comment": "Malware payload (Mirai)", "value": "c6e4360f97ad9c503c3632c86ae3009cedcedd18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764628279, "uuid": "bf11aa37-04a0-4fae-a28a-fd07e6caee11", "comment": "Malware payload (Mirai)", "value": "9ebe1f2e666fdd4a4e28e7532c190d024ead5b53cbd252b64bd4ca9d2094ae4924bb08b9864532a01ec32e3c3a5ad664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628279, "uuid": "20f8fa1b-50f4-4abd-bd89-fdd9218d58fc", "value": "T1BDA32A46FD82CF13C5C623B6F7AE018D37157BA9D1EA3203DD25BFA1338649A1D2A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628279, "uuid": "da654526-e6c7-48af-88d0-bd3dc170cadf", "value": "1536:bdFU9gYSRBemTV9dlV2fT/hMAOi3keQks1YfpKOxnXv/8wf:bdFU9MB7VNu/CAjUeQknhD/8wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764628279, "uuid": "89b31252-fba6-4716-91e2-983e879ba606", "value": 103444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764628279, "uuid": "63c81726-7bea-4147-9034-649931061e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764628279, "uuid": "430e21ab-c434-4559-b23a-af3c439a95c0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e177f952-ce64-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764559312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764559312, "uuid": "3137bbc9-e124-4476-aea4-075a75d11f00", "comment": "Malware payload", "value": "da7994f6d035f16cff8708ad13b17ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764559312, "uuid": "5697144b-df10-42a0-9ef2-6858ba9cf2be", "comment": "Malware payload", "value": "ed57c70fea390a98b910b05c84e65981fb5e88e67e4a47afbeb57a0e843c1bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764559312, "uuid": "0ca41069-f9bb-4384-83d7-bf004ff9a6f6", "comment": "Malware payload", "value": "363606d2debbce860db095edcf575fa76672a67a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764559312, "uuid": "96e3912c-3452-44a4-b029-6e5888fab476", "comment": "Malware payload", "value": "3980a7e973844dca91c579dcf05fc263416b0db96965f84f4e48d256a7a14810493ad8560a661d40a6ae4ffd7560ea96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764559312, "uuid": "e319b321-c03b-495f-9aec-a894d902a94d", "value": "T1D5924453C2B4208DF276C57BC1710B79AAD630EC1B9A1CF186C44568195FCC97E2EEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764559312, "uuid": "0800ba32-6111-419d-b8c5-aedd7d6de5d9", "value": "384:0RXXtXvXxnXaXsXXSXXfRmXxaXkiXERXXX1XF/XUX6XWXNX0XvWXDXaXLXSxfX0A:0FtX5pwfgNk9Fmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764559312, "uuid": "1e5d209f-cbcd-4aef-841f-5d60a9da1f2d", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764559312, "uuid": "d36b5c25-93ba-478e-8800-2ab96a2daa71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764559312, "uuid": "7eaa4847-69af-4b34-96f2-d746a062020a", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e7e1f-ce9b-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764582745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582745, "uuid": "f4dbe3ea-1207-451b-bfa6-70c051df8843", "comment": "Malware payload (RemcosRAT)", "value": "ce5724d4f37b9eeda6360757992aa2d8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582745, "uuid": "bd685d39-089d-4ae6-9999-f7f323b80666", "comment": "Malware payload (RemcosRAT)", "value": "ef351f85134e5e0f0f6dc37a8fcc559859da6b1e804ac78da565b515908e8b32", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582745, "uuid": "d238ea95-76f4-4ac0-81c6-5a4a8d8ad856", "comment": "Malware payload (RemcosRAT)", "value": "1b6dd0a77f2ccccae962234c78124d918483deaa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764582745, "uuid": "f138cb5d-38d4-4394-b2ed-127601a4c224", "comment": "Malware payload (RemcosRAT)", "value": "53c76fd06945c6c01658fdd76ba19484823a68cc0d8c2b86ef78c7be0dee3f07ccbfcf3364d2469c06bcc6d8933a3310", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582745, "uuid": "784e009c-9cf8-48b1-ba51-762e1192d150", "value": "T12DA42367EBD12EBC402176009B8B2C25B86F5AF8BA46C30C18B77E48947231D7E9DF55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582745, "uuid": "ec513f5f-9cd9-40ab-af56-284ce65804ac", "value": "12288:CSb8aYTyxWOMW99kGLM9K+A1uHphFayrk1xF7W2j3+At:CSb8aYTyDMGPLM9KGphPCxF/3+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764582745, "uuid": "2b360fea-8bec-41cf-8c03-944207da50d5", "value": 450057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764582745, "uuid": "976d8cd4-1c07-408b-8b9b-6842611e0246", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764582745, "uuid": "97eace3f-c180-46b6-83b6-8b3b627a5864", "value": "TRF25011263.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e3f673-ce80-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764571241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571241, "uuid": "8ae3bb14-a3d0-4bf8-80f8-65d1bfb8589c", "comment": "Malware payload", "value": "c30ee969ff39cbffba848fb41d2231e5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571241, "uuid": "309b33ca-aa30-4988-809e-3ac2e0c4ff6f", "comment": "Malware payload", "value": "ef9943893cd290e721c29d0b65ee3eaefeb5151aaaac15209bbc30ec901f3c3f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571241, "uuid": "029601bf-b633-4ec7-b24d-13deec1b4415", "comment": "Malware payload", "value": "c716d4ebdcce17e81da995ca077183288e5452a3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571241, "uuid": "aa3639fe-3382-4282-97fa-a804ccc8f342", "comment": "Malware payload", "value": "8fc96166cca35c00acc9bb6bfafcf1426a0119f83e2eefdcf5af4e54fd001aa1458511029f4c120821ad03afc19456de", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571241, "uuid": "ca281f4a-d796-4bfb-a056-3088564ec08b", "value": "T114D0973F925FEFBC12080843A2BE30EEC870CE82C88946A1BFE7C45D018443CE91A001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571241, "uuid": "a5ac852d-aa9e-4316-9d79-6c360a1b00a7", "value": "6:sny+t+jF2QyCZeON/5aVuvkd4chyASss3lMZti02:sn0R2rCZDNhwmmyAZy02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571241, "uuid": "d27a2477-e214-4441-9738-da07f26b1c5e", "value": 247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571241, "uuid": "604fa00b-4f65-4fd8-afc7-fe742e6e9098", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571241, "uuid": "30858dde-0c73-48b3-af0e-ebc8d9103c48", "value": "concatty_daddy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605b0534-cea9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764588730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588730, "uuid": "a2fe2f81-b7a5-4cff-b320-48353353a2a2", "comment": "Malware payload (Mirai)", "value": "b02f32a5790a4108a04539d21ee86452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588730, "uuid": "6e4081cb-f2b2-4665-8b2b-289e69a60903", "comment": "Malware payload (Mirai)", "value": "efdedf4d6d4ee19fa6ba6b6913f8ddaaa7c8a2dae07cd750979b40e2445108e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588730, "uuid": "dffd5d6e-44a3-47a5-90a0-e1a9b9a6458c", "comment": "Malware payload (Mirai)", "value": "31878111dce8ffe925b308b1777b9e8f70973d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764588730, "uuid": "c66f972d-c857-4110-8aa9-01cf0712cbef", "comment": "Malware payload (Mirai)", "value": "fbfa54dcf77b085ae398c3a14238aa9b037adb56b99aaa023acdb1030d88c24aede26b6889ed209d68565f605faa37a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588730, "uuid": "f4701b19-b79d-4886-883d-9ed127f26569", "value": "T14B23F11191D3AF80CA37C4BE0A65FB8EB4E9D25540AA8FE1B299B0764290F3F2771345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588730, "uuid": "af5d04c2-e346-41ba-be63-dc779d6d6a3b", "value": "768:SIinmP2YwITjZDXL0LlHwWNE7IooA29Uyu1y6LA4tpI5LcKJfVxJv3tdnbcuyD7L:ScjLpLgPUb8+ds43ccMnRddnouy8Gy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764588730, "uuid": "546418aa-7d5c-47f5-a967-257852cdd417", "value": 47304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764588730, "uuid": "67548873-d497-49cf-9948-e936e818c63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764588730, "uuid": "25b6a1ac-1b9e-4ddd-a98d-3d13a72ede9b", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1259d9de-cec8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764601914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601914, "uuid": "c8e3ee6d-f5ba-467d-92b7-a1dbbb026d6f", "comment": "Malware payload", "value": "b4405d054c11ced5641c147ac4a14eb8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601914, "uuid": "3a77460d-753a-4fba-a780-3c1290f30a9f", "comment": "Malware payload", "value": "f20292d0787b75f04f3d148a821db52a1860b844bea636fea8a6801cd2ce621a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601914, "uuid": "7a3064bb-7f79-4926-99df-05fc9c7ae414", "comment": "Malware payload", "value": "72b12ecd0f7f23dfdb2f95cff380b5fd520ea8e1", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764601914, "uuid": "b81bb86e-8917-4665-b723-46da2d4ab727", "comment": "Malware payload", "value": "8692583dbca7dc1af977d731c26c31fc117e419d555d03b44d6cdaebf56e4bb62c81e518827fe8767f73babfc31c89cd", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601914, "uuid": "376e84fa-2d39-4bea-b299-ed353b021cc2", "value": "T1C9D58745ECE8DC629A986BEC374144377157FE4DE0FA2047F66328E70AAC8E055ADBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601914, "uuid": "ed8bc5f8-b8c6-4dd7-8a54-2f1dec6b643c", "value": "12288:MW4f7wxgW4f7wxgW4f7wxgW4f7wxgW4f7wxZCrjyGkNy4g:MbXbXbXbXblrjyGkNyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764601914, "uuid": "822abc0e-4070-44fe-860c-d844664ec25a", "value": 2837454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764601914, "uuid": "17b75495-26b8-4085-8531-68233e37f052", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764601914, "uuid": "0d720ad7-ac62-439f-91ba-9694c09f1b5a", "value": "last.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff125eb9-ce9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764584702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584702, "uuid": "923b5a08-924c-4eea-90df-c7efdec2e4fb", "comment": "Malware payload", "value": "3a5ef87c7b68195378c6f387a4c0705b", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584702, "uuid": "d72878d0-5159-44d3-83cb-c1e64f366e62", "comment": "Malware payload", "value": "f2696998cf01f315090c11fade086687e25471566109d8ffd1fee085c66b2f13", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584702, "uuid": "d493dacc-ddbe-4482-9960-d448b9b64ce8", "comment": "Malware payload", "value": "4f2f08dbf900aeb1ac33e1f2e8f35c29eed411f8", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764584702, "uuid": "5ac1d2fe-e604-4a9e-a836-31eadc90c64c", "comment": "Malware payload", "value": "cecd4ad4d782507b77411d682f6af152fe5b980543b5aafcca4238618718ff9556c157b8e643a1e5b37b9be42d0f2b5b", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584702, "uuid": "c4cabc0a-32b9-4071-8bda-bfee0cd7feed", "value": "T1257302942747820DC2732C77BD986A2B171404A2BB948BE74068FD2E37BF4A5C6B2775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584702, "uuid": "3417504b-9c54-4d9a-a10e-bee706780618", "value": "1536:kfoAkUTtx2tvD7n96LQ9lH839F7qI+ECASh0FrOplzEAvZO1sJxfmPiZE:0EeitvdnkNF7qI+ECVhiapB7JZmPiZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764584702, "uuid": "7146c343-d1b7-4c43-94a1-29268a75f4dd", "value": 77055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764584702, "uuid": "681ef1c1-b31b-46b8-ba65-67f28bee51ef", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764584702, "uuid": "255db334-1d44-4adb-8795-e30a202fe421", "value": "27OLY_SP_32_0201.XLS.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e85a389-ce9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764583949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583949, "uuid": "1b1cde61-3833-4888-9db5-e09346724eaf", "comment": "Malware payload (Mirai)", "value": "b74ebfe355e93cd0180dc09f9b5a2d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583949, "uuid": "b03739bc-c6cc-44d4-85bc-7f57353eaf64", "comment": "Malware payload (Mirai)", "value": "f404512034935698e233dca6029dd9500b25b672fdfd681c5947cd9bd615443a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583949, "uuid": "c5e0d51e-a24f-4fbe-a4c1-83f27973d886", "comment": "Malware payload (Mirai)", "value": "8e133735e5923e1db47e0e163ec1c4ef56e2c9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764583949, "uuid": "b2ce9f5c-f6e6-446e-82d2-ec906286d349", "comment": "Malware payload (Mirai)", "value": "ccd4bf0f88c500ef0acbb1a3c19a4ea543441d989aceaff58675ff56f4ab6dcbce17c7fcfec4fc368810cbc14b5d6b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583949, "uuid": "f8e4b4e3-e34d-4840-a07f-82394265d58b", "value": "T1CDD3CE30E4509CC6EC2109B5347AC9B80750AEB407E61682FFFEE95EA47BD4978AD371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583949, "uuid": "a3362dab-71e4-4ce6-b1ef-67b28537eb91", "value": "3072:/MZRulir454uELkcwc8Gako1ENG4Z2ce:/MZolI4euEQWc1ENGDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764583949, "uuid": "35c1e710-62bf-42d8-b118-ca2a8bf1cf41", "value": 131676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764583949, "uuid": "39c750b7-7bfc-4157-ab07-94ff2b3ec18c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764583949, "uuid": "3dc49938-0f93-4386-bd96-b87b16156101", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce340c0-cea2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585987, "uuid": "a60ab454-fa01-4897-8b24-384ae18de0f1", "comment": "Malware payload (Mirai)", "value": "8ee0bd38ae611b802db2f90f6d7c8857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585987, "uuid": "b19bd80a-4e31-40df-80be-53b9cbe8db94", "comment": "Malware payload (Mirai)", "value": "f42a960c0a6d49d775374265809840f3f3a234e7494352c2d8849191df802e3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585987, "uuid": "20a10ef7-6dc4-4215-a9be-e808e0b456d8", "comment": "Malware payload (Mirai)", "value": "938ef1fe806d69a612c19dd303b16043a9fe75ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585987, "uuid": "11e28deb-79fa-4d38-9c32-44911a6b4e5f", "comment": "Malware payload (Mirai)", "value": "95c581065ddc9ab686c0afd4709dd2ca84d6666dc3fc04ca8b27fd85bf02038a0f91d583a0d5d5da54f63b1e48b4d563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585987, "uuid": "08bf5728-1c81-41f3-9365-62d7b57d8a31", "value": "T1E3230287E51B956AF03334BB18AAD0C5DCB26CB9522B97B704D5A75F0CDA04F3802723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585987, "uuid": "03904f07-2fc0-405a-921e-5a947f2c432c", "value": "768:1tB548w628WWpbLcWgmL01yPFzmiRdWqsGsjmqbW+NVqsSiiOPF6IzzYl3clx05C:HBw62YcW70kFmixqLNVL7zzk3cAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585987, "uuid": "311e4a5c-12ef-4512-881c-c3d17e80cd10", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585987, "uuid": "b2e24704-7091-4e24-b5e2-a2f8340e216f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585987, "uuid": "0e78b8d6-985e-41e0-9bf7-93197235f8f7", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2ef352-cea2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585928, "uuid": "9d2b0233-a509-4703-b534-7d97a9e45b9b", "comment": "Malware payload (Mirai)", "value": "db0425efcbe60db6618490457999d8fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585928, "uuid": "8a77f5de-2148-49cc-861d-a5db3905b336", "comment": "Malware payload (Mirai)", "value": "f44c3ce6c760a022f3faad235c0c6909d3d5021a8b2bdd1b0eb29a68ef1f9d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585928, "uuid": "51e1a75f-da45-4630-975c-5b57d755af8e", "comment": "Malware payload (Mirai)", "value": "96c871ee310ddbbc42b62faa317dc1a942c09e5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585928, "uuid": "51af057f-4398-4448-9e33-1cca78eedb38", "comment": "Malware payload (Mirai)", "value": "8b9693866802bc6f3253c36ec7e8efa702c31200f4215ff206c8da3112584fd7ac0ad3bcc125d8cd07dfbb42a1cd0e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585928, "uuid": "63192bb8-f212-4b14-8503-294248cb73e3", "value": "T185144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585928, "uuid": "d109c122-e246-4154-95a3-68a7ee32a9b6", "value": "6144:9MygR/fQdiYpxN4aTBMvlZe5cgCHMhMm3r5M/9pTKF:9MBR/fQAixN4aTBMvlZe5XapMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585928, "uuid": "938436fa-6140-4584-aaef-71a380c43a86", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585928, "uuid": "eb287ffd-fb1c-498b-b5b7-45049da72150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585928, "uuid": "5b55e4f3-b033-4307-b9fe-4a1446a27cbe", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab8173-ce75-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764566360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566360, "uuid": "30fa3b7c-9354-4ce3-b408-97259a04ab29", "comment": "Malware payload (Mirai)", "value": "76f14b4fca9f6a12ac6435b7c88879f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566360, "uuid": "de450465-e9b4-4dc1-8e99-d064f71e3c50", "comment": "Malware payload (Mirai)", "value": "f464d4c735b00b350fc784274ef5887f2845bc7dd81d7e9b8271cb763290d1e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566360, "uuid": "24341122-bc48-4c52-a95d-1654e817fd8a", "comment": "Malware payload (Mirai)", "value": "8cddf4ea39a3a7f06a6b9bac9f6b33108c23d04d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764566360, "uuid": "b6f6d341-a8b3-4323-b6b8-622cb1195a8d", "comment": "Malware payload (Mirai)", "value": "85dbcdcba6ebbcc5a8346c55344568dddaa3b2ad3d1ec09a54c3f147761b0eb42d581f8fe756af678f975f4ff8bfdaa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566360, "uuid": "b66b8491-7de0-46ea-b2fc-75178890d1a8", "value": "T1D5E3E70EAE358F7DFB99C23447B78E25965823C627D1C581D2ADE6011E6038F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566360, "uuid": "df3e36d0-526a-4a03-802c-f408ee3c72f8", "value": "3072:jtRKxKYZt4wY6bludObqRSQ81QywJMQXb22rP/UXan1mKJ1x3C8pepHg/MjDhQip:RRKxKYZt4wY6bludObqRSQ81QywJMQX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764566360, "uuid": "3c23e223-2d0e-4b13-9d5a-5d3124ac4f82", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764566360, "uuid": "569798f6-dad3-46bd-8c6a-386f693270b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764566360, "uuid": "b07f1915-e1c6-46a9-9d50-74ebc39c4adf", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063ef156-cee1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764612631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612631, "uuid": "22476bb5-9a83-4a2c-a160-0c116538857d", "comment": "Malware payload (Mirai)", "value": "c1266b91351eca6e034baccbb0f1b78d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612631, "uuid": "82862c6b-1fbd-42ca-ab17-f051d109fb8d", "comment": "Malware payload (Mirai)", "value": "f475787d6e2f64cb03a8d890ef432e2da4c94f1ad10617259927d9b06b868a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612631, "uuid": "bf7c1893-d031-48fd-9746-8f6d4b721eb9", "comment": "Malware payload (Mirai)", "value": "9f2fb2b658967f9e078672e5b8e78a9ee47a28fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764612631, "uuid": "2d9acbc1-3179-4b7f-9195-bc1a2856ee53", "comment": "Malware payload (Mirai)", "value": "b4add86e1a3e75b035db8451d96c0ff2beefe53609032febe3c1bc11bd4cbc095cdb52a4e64bad81d52a7aa24289bc2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612631, "uuid": "c49394f5-83af-4bff-8200-26516af95d2e", "value": "T197C3E795B8819F22C5D156BFFE1E52DD33231BB8E3DE3203DD186B2476CA91A0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612631, "uuid": "28ecf321-de05-4d0f-9280-e04ab185f9c2", "value": "3072:7PKfP1ctg7z07hM+ltgATch/TJhd+4TxonQXirOjUnU1on5e9:7P4Ot+07hMstgAQlbE0AQyrOZ1me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764612631, "uuid": "dbb0b7a4-de3d-42eb-9459-e9a7130bf5e6", "value": 123604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764612631, "uuid": "0f77c9fa-16cb-4527-9c1f-421b55929546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764612631, "uuid": "a8a9a7dd-20fa-4ff0-b131-6a2dcfc87f77", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a2d8a6-ced1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764605844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605844, "uuid": "5769cbd5-48ae-41ae-a3f2-53cb9f7a2a9d", "comment": "Malware payload (Mirai)", "value": "7311c957c85ab58dd5430f96c14d835f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605844, "uuid": "59a0e0c5-bc1a-4f76-afe0-8438b250ff17", "comment": "Malware payload (Mirai)", "value": "f67e54605a78dd6ffd63612656521479529fe842937256990e79045bdce6f2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605844, "uuid": "a79cf487-7ded-4d81-bd53-1f104423bfa0", "comment": "Malware payload (Mirai)", "value": "ec56ba669a089108cf41e1ca0f9017c774f49d16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764605844, "uuid": "32731543-21eb-4bd3-87c2-be533e1ec97b", "comment": "Malware payload (Mirai)", "value": "90169f000be0780d0d102334489f4acbfe190096365055b08259fc4f66e18429a43b06620cb38ab26aed735dbfda21fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605844, "uuid": "2885b28e-f220-44be-a5e7-87f49ef79345", "value": "T138C4394ABC908F51CAD53ABAFB5E82A873574779D3EA71059D140B3437CB89A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605844, "uuid": "dcc3522e-f20c-4a37-98e1-a85e279bdc4e", "value": "12288:sS4QgtUaTZoiIfbe789ATkk4VUcJxAHF648/JWVvprW7Y8aif93cJw3VbEojdkt7:sVtUcZoiIfJJMBUYYldktA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764605844, "uuid": "01abb967-98be-48d0-a457-0b1d3048ea3b", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764605844, "uuid": "8d8ecbdc-bdd1-4317-a6d8-35b6080b5d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764605844, "uuid": "8f6e2396-0af8-41b2-8c43-11981452de80", "value": "sync.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9319c3-ce85-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764573504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573504, "uuid": "9991fa48-1103-42af-baab-ecffa9738430", "comment": "Malware payload", "value": "c3c511f5721aa99ed2d30b849a793c56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573504, "uuid": "cfa9bf85-b9de-4ac5-9c28-df4ac8487888", "comment": "Malware payload", "value": "f7d254b49a0d581a03527bbf6f7392c0db18cbf39196a24212e9eba78b56c6de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573504, "uuid": "dca8c3b4-a121-42a7-8a58-3af69fbcc3b0", "comment": "Malware payload", "value": "a581de380226796c42df4e84fb7ea688bff97102", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573504, "uuid": "15e504a2-2f1a-4f3f-8396-331fdf558939", "comment": "Malware payload", "value": "fa6d2939170db58d348f5b1322dfd13204cc8919248c21b9745713103317f7016b71ba0dcedbb842b220aa3159600c6f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573504, "uuid": "81dd6769-7a85-4bbb-8adb-164769e4a8d1", "value": "T187D3734062C1B8A403971F76771FB9D5FD3F09D93498498BC161FD90B9B5B0AEAE0A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573504, "uuid": "9e7df96b-3fa9-4fb0-b3a9-639fa718f064", "value": "3072:YbBpBN7kiBka+7xrl+NU8HJBeSZ9W2tmkZJCatDo+tvOmenvWMRaAS/Ub:YbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764573504, "uuid": "f9e5e4ac-b6a4-49a5-9129-261bdbbe29f1", "value": 142111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764573504, "uuid": "55a43ebf-6203-43b2-bf19-0a54e0eeb77a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573504, "uuid": "63c3be7b-43de-4319-8fcf-103834678682", "value": "E07777U3847XMCJD28384372.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5ad79e-cef4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764620991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620991, "uuid": "ddc87f72-0dd4-44bc-ba06-7a4b11c48dd7", "comment": "Malware payload", "value": "fb192ecb6afc819d7303d62674c35199", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620991, "uuid": "48430e16-9a25-40dc-aa65-04c3e94c49e0", "comment": "Malware payload", "value": "f84b00fc75f183c571c8f49fcc1d7e0241f538025db0f2daa4e2c5b9a6739049", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620991, "uuid": "a508f389-5c36-42ba-8d7d-8db93bdd5b53", "comment": "Malware payload", "value": "adc966fa648c46097b3951ad2a750f53175198ad", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764620991, "uuid": "07ee70fe-e83a-4683-a17c-3dd1e0ac9e6e", "comment": "Malware payload", "value": "85a34c101e3ced4dfe504dbe45055475516968e695ea7c790aa6a021fd47067dda418608b1a5e3edff369d0005a4587c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620991, "uuid": "c56bc13f-eb1d-4832-8cb0-fe96d27cc3bc", "value": "T1820733B609F15296CCDEA1B1182225C75106A737FFB3203AF26B2FB206E5477F352925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620991, "uuid": "2b9ec605-85bc-469f-a227-e12330201f77", "value": "393216:u1nfYcH5b0IoFjALQVB2T38+WJ3vXS1InTQxtlEf9Zo+g:udYcH5b0IZ0iT8vJC1InD9Zo+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764620991, "uuid": "162be9be-250f-403e-af89-72a38590623c", "value": 17713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764620991, "uuid": "6fa6f36e-4df2-4faf-b9f3-06aa12f17cd5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764620991, "uuid": "2898f6e1-0d9a-4627-af74-c68711878951", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1000aa77-ce87-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764573993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573993, "uuid": "0e32807f-ba0f-43a7-9889-a9bbc059c945", "comment": "Malware payload", "value": "fd7b6ae9e1d76276ff8e1428cac60432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573993, "uuid": "5e75b944-d3e6-4bed-badb-6f6b7a14c52c", "comment": "Malware payload", "value": "f84eef10ee0e731e9dace154d12fc6e9e762a6565cc1be838d9d8676f65fa362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573993, "uuid": "7eaf10bd-18fb-404f-9ae6-89a5d441ec87", "comment": "Malware payload", "value": "a60424dfafc885113127ab66d50ff5ced24a1a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764573993, "uuid": "5cf3928b-c58a-406a-b456-ab2bacae4e2d", "comment": "Malware payload", "value": "47072e641b67d0c937c5b0b21ea86d3352d8ddbf6508bb464f10a635e4fedfb027a4fe52b27f09a3ef0666f0d3daf1ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573993, "uuid": "572d1c5d-76e0-47ea-a5f0-aae05f865537", "value": "T1AAE408FE7707C072C8001475AA67EE6547584C604B9233CBB2D87DED4EB12F9BE2166A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573993, "uuid": "7ba33207-2474-46ef-bf63-91363e74fc6c", "value": "02a0469cf70f93b9317c465613bd43c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573993, "uuid": "0bfb25ce-7d07-4407-9a01-10dd3c97297f", "value": "12288:5ySbRXm5u8WXSCqT2JuGgNx6xxMxbAmxxxxHxCAYBUxxRxxhxxHxxLgxLxxhWuxR:5ySNdYTGuGgNx6xxMxbAmxxxxHxCAYBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764573993, "uuid": "9be5fe4d-5d04-4166-99ed-22a021066918", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764573993, "uuid": "35367c12-964f-497d-9956-1d6c192393c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764573993, "uuid": "59059978-0392-4d57-8350-760f18b9a9f2", "value": "Invoice-2025-76A-3696511CDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12975e1-cea2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764585860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585860, "uuid": "93e5728c-293a-4ce1-9d60-1d227ab18919", "comment": "Malware payload (Mirai)", "value": "ec873c488ec9b4a04cfca7f33eba1177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585860, "uuid": "c1998fca-abd3-4e4b-8da7-b61159941462", "comment": "Malware payload (Mirai)", "value": "f8ad4daab6d3dcba4d818dc0063b7f31778a253283695fd2940baa30a5ed3816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585860, "uuid": "e931adbf-15d7-4259-a1fa-d62f2f9d2840", "comment": "Malware payload (Mirai)", "value": "d1e897a3b8f96e73e1f26538f0ee6df682710a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764585860, "uuid": "fb61033e-61df-46ad-a539-31a61d1cad3c", "comment": "Malware payload (Mirai)", "value": "d929dac7cee6e28da81fe4278a46dec2e12f8cdd511c9a2e972f5253e4e4e663c26e72f8eb5c55e54f89c35fda9ff0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585860, "uuid": "fb9c920d-6da4-43ab-b4c0-1ff405a0ff25", "value": "T12633F168E554A947E36A4C3042D61F6A1830E28CF7EB1F8887572DCE3B1ECBBC548974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585860, "uuid": "ebc43b3e-48bf-42ed-9f18-a822baf9bd2d", "value": "768:CVPEFUoG3LZ3abs+FIjN05WNDhgJt4kbn47jjIntJXOSxeg0mPyJFx9GMZWO:WPEoZ3abs+SpougJtJnKAbOSxMC+9xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764585860, "uuid": "455ab506-9aae-4175-b427-f5818e75762a", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764585860, "uuid": "7a0a2428-be37-477f-94e4-416f067381cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764585860, "uuid": "20b15e63-9e8b-42c5-9c4d-33969da622b8", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7c01e0-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764621235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621235, "uuid": "fabaca2e-eac8-4127-a33e-d1b673589a97", "comment": "Malware payload", "value": "ee22a79526a9539b9264a3ca1546b88c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621235, "uuid": "17af1105-374b-4022-9f8b-4300eb23dde2", "comment": "Malware payload", "value": "f90a9fb4813d7ed9cb40727922307fbe926610903a8e9d14267a0a0aa26f9029", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621235, "uuid": "e2ca3e8d-2005-4d5f-84ae-5e262a2bb5b4", "comment": "Malware payload", "value": "41066bf90788203bd3f5441020c35fc1cb00495f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621235, "uuid": "22bf1790-3c77-471e-8648-0009d51feda3", "comment": "Malware payload", "value": "9580383b3d5956a39f0a5e4cde99343bb2dbcf465bfafc6ceb44909e31317e457b29d1fc4e10dd6db333f2db19aced4e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621235, "uuid": "9cca60d4-0624-4c62-8721-39f23260e4f3", "value": "T103273359BA9CE10AF853E571C230DB13E18501257A88FA4B6F78C55C5EEFD82A347E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621235, "uuid": "65112cdb-f3b3-4415-912a-80b02c44882e", "value": "393216:eqump09N4rHqa8GlZ1DOUnrqvAQ8Iq1Kb0eWB4xI1WrGDQUOtHldNGoH2I3Bdg69:XumpIurHx8s9FqL8b2RWfpDHvoV3BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621235, "uuid": "fefa84c5-c926-4aca-8b2d-9e085d2f7bcd", "value": 21381359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621235, "uuid": "c1b3e5aa-b900-475d-9289-fb91e6a5ae12", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621235, "uuid": "630f7e3f-549f-4fef-8477-e7a797b8872e", "value": "HelloCS2.12\u5b89\u53539\u53bb\u4e91\u624b\u673a\u9650\u5236\u7248.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecd5ac0-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764621558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621558, "uuid": "76c77e3e-8d9d-4441-8e3d-358163efc31f", "comment": "Malware payload (Gafgyt)", "value": "5cb572660c3307a64733f5a8709044a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621558, "uuid": "e226002a-6210-4889-9177-d63c265af6d0", "comment": "Malware payload (Gafgyt)", "value": "faa6e632e8a7dcde4c0761e94f007891a29633951ba7a8dd85adfc135d6927fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621558, "uuid": "fe76deb3-c007-4e82-ae34-5778c758445a", "comment": "Malware payload (Gafgyt)", "value": "b1b7ada8df6969b75f874cafd396d48cbebb6559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621558, "uuid": "734aab40-0ddc-4406-bf97-487d6d5245bd", "comment": "Malware payload (Gafgyt)", "value": "ab706697467785f46e079eca407e1d6deda4562b4e3417423f2c9b09d46958867bf24881d748bfb1b2c3541e89af7c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621558, "uuid": "4608f7bf-de44-4307-a8a6-85ce39b219cb", "value": "T19EC319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA945E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621558, "uuid": "3f139313-84e3-4401-8244-eed0ff9ef84e", "value": "3072:EWpbc37+Qp2nrkGJc/M5h1Y7rCmJC0OzQaGyPZk:E9Lyc/M5h1XmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621558, "uuid": "6a4b9440-6f10-4432-9bbb-dfff0a191ce7", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621558, "uuid": "4128c3a5-3e16-4052-80ed-3f57ff769b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621558, "uuid": "3f564879-41cb-463b-a3ed-056504a6e6fe", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57eaab2-ced7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764608711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608711, "uuid": "f3a9d91e-5f9f-4663-ac23-fb3751d161d5", "comment": "Malware payload (Mirai)", "value": "4df12ab6b12dee8e4c9617142d30efcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608711, "uuid": "28a2b46c-a1a6-4abb-a1e7-64ddd5d22b14", "comment": "Malware payload (Mirai)", "value": "fb166427d78042bff0dc2ebe6b6348718dcbca2c2e59025c760988fd9f332147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608711, "uuid": "38071fc7-4de5-4641-a1c8-b4b5c3c75887", "comment": "Malware payload (Mirai)", "value": "6f93a91f6cc5daedfa3ccad99591b75f36884771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764608711, "uuid": "e8be4f0c-f7db-4f6b-914a-7fbaed615550", "comment": "Malware payload (Mirai)", "value": "73406e2a10747cbbf7355d03dd0b0667bfcfe0b7d9755db293e0eba4a91fa87afcdd1901320a8d4a58404a78160a332c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608711, "uuid": "35264fac-dfff-4880-b3a3-dddae05229b8", "value": "T1CDD2D0AAF3426359E83AD6FC0BD19B680EF00FD0E4011C199887DA119E873E8B9935D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608711, "uuid": "953a7296-3fe0-423d-a910-c34aa0acaf34", "value": "768:SMZuY/XDg9c5Hdt5pSUNrVatGX5nPJgGlzDpbuR1JM:S4ic1JpFJa4LVJui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764608711, "uuid": "3963ebae-23a9-4c22-9138-c089be8d90a5", "value": 28308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764608711, "uuid": "6eb3a622-28d4-4184-969c-96abe7e990d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764608711, "uuid": "4cb09c34-d1c1-4c14-add6-55bbafebf5ae", "value": "niggah.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc5c5f3-ce5d-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764556215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556215, "uuid": "33ac71a2-ec89-439b-b638-356b39827737", "comment": "Malware payload (RedLineStealer)", "value": "31f40fa1c79a2781fc62c981b5d0a6cf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556215, "uuid": "a2d33715-2419-4fd8-aa93-d0ac77849d2e", "comment": "Malware payload (RedLineStealer)", "value": "fb4a9b0d3a31bc01158495e2b51707d845e781c3e2d4b3327ee89f8d82fa9baf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556215, "uuid": "1c37b633-929f-46f0-a2ad-1cf936c1725c", "comment": "Malware payload (RedLineStealer)", "value": "3a5dabe6504fa283b83a7cae897dd03d2227f19a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764556215, "uuid": "0939d1ce-cd0e-4882-9ae5-383292efc503", "comment": "Malware payload (RedLineStealer)", "value": "47ec3ceb6d6e3f5c4415ea9932ccc86e6af2d4b01b58aef6fe99a4823bb496053b32aa46174ae2b195fe1965ee41d0bb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556215, "uuid": "79f85f1c-0a1d-4b1d-ab9c-f4352999b8a6", "value": "T15EE423BB03424B24083C82E26705D6B0EB5ADD55583B1287CBA45EDDEDA61F3DB3839D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556215, "uuid": "81c29288-9c6f-4f88-acb2-c36b58707c1e", "value": "12288:ZiO96HZ4b48Mt/eQWYP9LOX1PR4xO4WNHKuprc5JanNNs1WbrTk5jeplPgcNIkTx:L96Htt/dWyL61J4g4WIgcLw3brhdft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764556215, "uuid": "021a0cdc-5ef1-4f53-953c-9911811f869a", "value": 673613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764556215, "uuid": "f80e80b1-3d78-4803-a0c8-3664c4671640", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764556215, "uuid": "789b8474-ac56-428d-8620-ea9ebc84c540", "value": "n0008917682_OUTSTANDING_20251128.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c588f8-ce80-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764571098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571098, "uuid": "661b09ae-d4e6-4d07-a2dd-23c182044c22", "comment": "Malware payload (Mirai)", "value": "910c33e4980530d1605c15390213e989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571098, "uuid": "f6542655-2f7e-474d-8cc0-0ab34b352be9", "comment": "Malware payload (Mirai)", "value": "fbaa2083f4322defe719fe7efcb67741d5b7c0ee1107f696b548dda629bd69fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571098, "uuid": "fd22bf40-ee3e-4fd6-8890-b6818731a1b2", "comment": "Malware payload (Mirai)", "value": "784a06dc666922247571de66474425e8a4b2143e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764571098, "uuid": "61d2b813-baff-4e13-8d2d-9de7fe303793", "comment": "Malware payload (Mirai)", "value": "30ae951136d4d4addfed35861d2a0261c4873250b9177cc6a6babdd85d7f5bb35ab981e00a893d163172c68c767f96bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571098, "uuid": "27757109-d323-4a9f-918a-0717461fe636", "value": "T165A36CC6F643D8F9EC5605343132FB379F72E5BA2129DE83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571098, "uuid": "def3fa76-a11d-4393-b09e-72f7b98ff7e9", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1QrUSr1pAm3Jn5wR54yfZLi/sd:FbhWbT+c+sxK2mlQrUs1Z3vY5Xi/sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764571098, "uuid": "ccfb1f83-0c12-4f92-a63e-358978a231a5", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764571098, "uuid": "f8c6cf38-218f-4170-8ef6-e4a3098f8a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764571098, "uuid": "1ab651c7-b997-4c85-977f-80eaa9127d61", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aea4d61-cec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764598519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598519, "uuid": "b3b8b0e4-1f3d-443e-8981-dbe7bd00129d", "comment": "Malware payload", "value": "6528d33b73cc5e32e37a8af981961f3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598519, "uuid": "25254509-8ac6-4c0e-87f2-6643ec3dcaf2", "comment": "Malware payload", "value": "fbe9cbd20b1447fbc3005d50bd5b969b509266cab8b1fe3cf385506815d650aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598519, "uuid": "6ce59fc1-3020-4daf-aafa-ae1d39ce4e31", "comment": "Malware payload", "value": "e47a44379d67e03505d8b70bd7a5689b2bb88d94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764598519, "uuid": "193cd21f-57c8-4d7c-9497-af128ba70a96", "comment": "Malware payload", "value": "13f0b16c7c6bfed0abce6f68a00912deb1de2e3adc7bce188323320bf43d8be9f43193e3ac528ee71a232853d481ed22", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598519, "uuid": "c276538f-4117-4c0e-815c-f5e4d4ca225b", "value": "T1F2944B0C27AC9A33DB0F3B3DFC712519E3BCE00B514B9B1EA697E9AD28533228525557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598519, "uuid": "d186166e-ce48-443c-a8cc-d3296b4233f0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598519, "uuid": "296daefd-2d54-4e08-b3fc-6efd7895c23c", "value": "6144:skktfRXbRsl0UfCsuDDMTk90lLPFUQ4n+FEpmQKvhEsp14kIbhZRJ63:K8gMT9PFFU+FEfqhEPBz63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764598519, "uuid": "27015b8d-1eda-4326-9bd6-9853990a2f75", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764598519, "uuid": "2924a612-1f06-4bcc-9ed7-4f8ba5cdbc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764598519, "uuid": "785f7d89-9f3b-4585-b5e1-e80e5bb840f3", "value": "file.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6fe623-cef5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764621282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621282, "uuid": "831fe865-00cd-4404-9cfd-4d1a62c16bb6", "comment": "Malware payload (Mirai)", "value": "01a4157d84ca766496ebdec602f86747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621282, "uuid": "935fbf00-99f6-4eee-b866-7941add8aab2", "comment": "Malware payload (Mirai)", "value": "fc491aec4061f8dd019b6e30068fc1f69844cbd16f4bf3cab677d54cd84c8ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621282, "uuid": "1c842380-d7ee-4df3-bb71-9569b5a0f25b", "comment": "Malware payload (Mirai)", "value": "e066d62d73ae4d2767c6bc638f52cc2e4fea2529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764621282, "uuid": "9122fa17-d642-4790-af1a-1dd2d1b54433", "comment": "Malware payload (Mirai)", "value": "7d5fc91584ec3fc80d732fde7e6589896c778abcec9d640b153b58d1b55138379722aa1712ff7d70a0d891af9ee4fbbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "vtuber", "colour": "#E6FAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621282, "uuid": "7366ec1d-7580-46ad-b2d9-7aea91d06ff2", "value": "T1B6660855ADC26F6AC2DC03B454EE226662543E454AA1073323E4F7F83D77B3C9F5A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621282, "uuid": "dda24279-c3b3-412c-b11c-457f93a149d6", "value": "49152:q6S2Re8/yOkYz5iw5CURAxBjhKiYFXxAGb5g3oT4Eg5Eo:qj2gUynYz5iwVYGyVEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764621282, "uuid": "fc82eef6-493a-4dd9-bc58-d3c03bfb7e25", "value": 6684820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764621282, "uuid": "c40c4a8a-a847-4630-82c6-504c190057ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764621282, "uuid": "0af6a3d5-1a10-455d-a2e5-509e97163b28", "value": "laplus.vtuber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749433fc-cef7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764622265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622265, "uuid": "01c37ac4-dc62-4c6d-8463-87acb04eee1b", "comment": "Malware payload", "value": "7319f3679b37e6bf67e973817e393f0e", "object_relation": "md5", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622265, "uuid": "5df872bb-c679-4328-ac32-c2b0618f5923", "comment": "Malware payload", "value": "fd2d1ce509c558fa3abc0216530e8ebf1a7a9d7adab41df856b06dc80a4650f0", "object_relation": "sha256", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622265, "uuid": "3d1720b2-ee36-4f34-a71c-07b24c79108d", "comment": "Malware payload", "value": "730047312be14c63c17cfc673c0b1c5f338eb179", "object_relation": "sha1", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764622265, "uuid": "35a049d7-bf95-410a-a921-5bd0931101e1", "comment": "Malware payload", "value": "9ce0b4bc3f5767ab510888e201d49d9cdd71f70d05e29ca65b5dbeccfcf6b0549fb66c9b00c48cbbcf89f0149c4e8ef0", "object_relation": "sha3-384", "Tag": [ { "name": "globalsnn2-new-cc", "colour": "#857FE2", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622265, "uuid": "3f2eca22-59f3-43bd-87cf-3941a57392ff", "value": "T10572A8F864CFA96B68B552539D649D3AE29A2E431114B20F3DFCD2500FF5A92F34083B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622265, "uuid": "2d8a884d-4075-46e6-99b9-b5bd30c19516", "value": "192:oj5RB3001RTSvqNLt+BLKSyhNM4Bu7fbROCVLD6S+:o1VReiNLt+B+Syhi4Bu7zHVLud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764622265, "uuid": "4296f449-acdd-4365-8e88-143f3eae1b07", "value": 16344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764622265, "uuid": "5923f665-4225-47dd-b588-7ae42fc7e3e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764622265, "uuid": "9761d255-0a98-4493-82b4-97ef87fb06a3", "value": "aliases.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42edf5a8-ceb3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764592976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592976, "uuid": "aa0097ee-800a-4a31-a8fd-7d9d2b9d02c8", "comment": "Malware payload", "value": "565b91c7c39a20b4ae2ce5a1a1c19f32", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592976, "uuid": "3cfcaca5-3c8d-42b6-accf-2bd928399262", "comment": "Malware payload", "value": "fd5639a721613412c47af04829814d9b5808156d6196b95a5739a27b3324c8b0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592976, "uuid": "b006bf4b-aa46-451b-a4c3-64fa378fef4d", "comment": "Malware payload", "value": "c1b1136e571b3a7645f9c6eb0a6f76686dceb150", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764592976, "uuid": "95a0a824-c3d8-440d-bffa-afce9111cb60", "comment": "Malware payload", "value": "903d5e0a0ef2ebd2a1280ff907983157bb611b626af47f2aab943b4629c4bb1f22ad90f2d9ffa2b9af666839227e2b66", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592976, "uuid": "84c014f1-2723-42c6-bb58-8deabb58e6d9", "value": "T1E173414C0DCF82F8AB1774548ADF8C02F7E58813171CE9E5BB5DA9A0AF014B8B5E46E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592976, "uuid": "b9c93361-bae2-4117-bc3e-329b43480d8f", "value": "768:fhDxRHEFIfx+WzOhahD+uhEly1KekYhbjny43wKq3cUMxRviowak4NGWD/fJINnA:6I6hnlCKSZpC7NnQO2xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764592976, "uuid": "2df94aeb-8779-4600-8ace-27f1cb115f1a", "value": 76542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764592976, "uuid": "49e33b08-2051-4c45-83bf-ea45d04cb305", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764592976, "uuid": "c2fcd0f7-cc24-44b6-981f-8f2685012b0e", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420952ac-cea6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764587391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764587391, "uuid": "1f22a680-e506-447a-87a9-1f05d8169f2a", "comment": "Malware payload", "value": "5b1259794552ef2393f816ce9eb5ae13", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764587391, "uuid": "33e7cc3f-aa01-4eee-9eb3-14012f77801f", "comment": "Malware payload", "value": "fe786c0fcce4628320d250c582c1243110d730f29afbdb906649ff4244d84ace", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764587391, "uuid": "ab6e480a-503e-4c40-b103-1c00c507698e", "comment": "Malware payload", "value": "cea9dd55a3f615500c1f6618bd1e1934e0a474d5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764587391, "uuid": "c883c29d-b170-44e8-962d-29c133c74437", "comment": "Malware payload", "value": "1803203ff303cfdd7e44cb31871c63c43de1e0029aa84ac19c782f2e0f21b606574744af3cdc8cb6505175d4d2506b87", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764587391, "uuid": "3107f1de-78a3-4de8-bf58-cc178d12c24c", "value": "T1B973649809CB60EC9E2B789C49DF9C12F7E54557121CE6EAFA4DF5F02F01478A2E89D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764587391, "uuid": "c7d83b0d-7e7c-4ddb-b7a2-ce73371deae5", "value": "768:9UUhhN0ETqxEmigBVpvttnyAvYebEkXJK/y2aZ2r4EV7TRk14g04Rdies3BZF/Hd:1/gSmXQOIiEVF64kycp7ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764587391, "uuid": "c72b22bf-aa3a-4c5b-92bb-46c910533b79", "value": 76305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764587391, "uuid": "2c2f3d88-408f-4510-9f6c-61f858df51d7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764587391, "uuid": "26c34418-65a6-4d05-9abc-04bb62e1a79d", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df38757f-ce87-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764574340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574340, "uuid": "eb44f1f9-c8cd-4729-92a6-a75241a11bea", "comment": "Malware payload", "value": "571ed5a8c02b84efd3eacdc234daa2d1", "object_relation": "md5", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574340, "uuid": "c2dd1ecf-df98-472f-92eb-e6466a9681bd", "comment": "Malware payload", "value": "ffe94f3846725c7b49fdd033555f7b568a19be7cb3399e3641c15eb1fc1c2fe2", "object_relation": "sha256", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574340, "uuid": "0ca4abb7-ce67-4daa-b020-c39100694b1f", "comment": "Malware payload", "value": "86c8edc8384d83286dfc5697068e5b1a03a1b822", "object_relation": "sha1", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764574340, "uuid": "ad469f53-62bc-4feb-88aa-57b732ea8f82", "comment": "Malware payload", "value": "e98573832092a2dff8765880d3686a37fa87c3e018071197603fe01254acf9ef29b667b1c3a3f8f244061239b03f7a95", "object_relation": "sha3-384", "Tag": [ { "name": "bknsitv-com", "colour": "#B86F00", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574340, "uuid": "95a23cfc-5240-462e-89b9-bd84ca5402f9", "value": "T126C08C260268026D9F95824858082E83A00A5088225988B279AE6488261233241C360C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574340, "uuid": "30b7a881-fd71-4adb-b1d6-e92a5c1676da", "value": "3:VSJJFI9IrFATH3x8XzYhG+QRwJAFCsxyxJ7CeFru1MFIKcprxyxJ7CHn:s8qOLh8X0URw5sxyvCKu1MFI3prxyvCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764574340, "uuid": "bf97375c-020a-4717-b7d7-711dbb425406", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764574340, "uuid": "edf189e9-1e7e-4e4b-a3a0-33fff094567b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764574340, "uuid": "d503a6d3-3640-495e-b968-447a7f9e75d7", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }