{ "Event": { "published": true, "date": "2026-01-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-01", "timestamp": 1767312181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4459af91-e865-4369-9ac2-9202e9cd5a62", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6094f157-e6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251181, "uuid": "4e36c0be-aab6-4f2e-953a-22d0bea9eea6", "comment": "Malware payload (Mirai)", "value": "3287546700d761840ccd39acdbc22816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251181, "uuid": "6e012e53-de09-4584-8e41-5d41c5757257", "comment": "Malware payload (Mirai)", "value": "003721494367ab31c6a5ba25d05f9b863580d777e731652994a24d51991fa93a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251181, "uuid": "c6e52d01-bef4-4a98-a687-eda8a1dfa29b", "comment": "Malware payload (Mirai)", "value": "e1022e523ce39a3ff5c988b30e9341221014a521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251181, "uuid": "d9ccf563-ac79-4d32-81fd-3086cb337295", "comment": "Malware payload (Mirai)", "value": "788e2a020dbfa492adcc9764f019cbe974bfbd6fc13ded2688a4fba51bd8bd381fdee1d2938c837e7a41a63b6351b8f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251181, "uuid": "234eb8a6-ee21-4bed-87b7-203365286a68", "value": "T1AA03E0DABFA12680D12ECC3764C91BF1C6A6B0C6716A1F541306C8C9E2B895FB11C9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251181, "uuid": "2d56b771-59d6-4e33-9667-2919a83438ee", "value": "768:Ng5ae1+aXuvtLEi1+KITQg31RTZDF8nTeuzauzi/tUaWfy:i5aeAZEi1+5VVqTewaUEUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251181, "uuid": "9cee2e92-fb5f-435e-9b00-99c11053ae91", "value": 37924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251181, "uuid": "1e7ee6b1-3150-4ec4-88af-58d3b18dad07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251181, "uuid": "70a4dd60-39d6-4639-a378-5716267ebf44", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accaf050-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304567, "uuid": "feea2fd5-846c-4c2b-b143-4302e3114e92", "comment": "Malware payload", "value": "8232f066d7529bf7f8143af27f391cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304567, "uuid": "96b762c3-00de-49ae-884f-8b3fa7f47b9d", "comment": "Malware payload", "value": "0113da9f6ca2e13c26a475550f5910eab7f33025856a8ee4a719d1e3d488bccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304567, "uuid": "a484836b-e408-4646-8033-962d2e3d299e", "comment": "Malware payload", "value": "4cc4092df6041505e15d4b6d5ac315caf76ee72d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304567, "uuid": "483bb2c2-eff8-4cae-ad6f-ce6cf6069b75", "comment": "Malware payload", "value": "7305d024737fa3bae88ce593bd343fb6ca57f5eadb4d5b318bf35176d2162baed543a65c07799b6f459f5324763ee2b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304567, "uuid": "a986b7cd-72bf-459d-9588-256b8a9c481c", "value": "T1CC461711FECB54F6E9031E3105ABA26F63315D058F24EBD7EA407F29F97BA910932219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304567, "uuid": "6d95b283-ee1d-4961-9cd3-898687584ced", "value": "49152:Qr32yCmfdiN3xTUuyDzyKCv6yfAky6UaxaOFKGk8SjZtO63p5E3:0myCmf+xTUuyHyKXlpWMbvE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304567, "uuid": "6ca8419f-d551-42fe-8dd6-c9593816f8ad", "value": 5677240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304567, "uuid": "2cba47ec-9554-4710-92da-7db78bde2a0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304567, "uuid": "5af5d61d-83d3-4491-a46c-7dc6a85763fe", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ad6aab-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233364, "uuid": "9c91f772-2086-4288-8c93-ba6002c24cf7", "comment": "Malware payload (Mirai)", "value": "83f9836d0025efd107ea46ed043a9167", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233364, "uuid": "f9517837-abc2-4edf-a196-d9fdfb4a5074", "comment": "Malware payload (Mirai)", "value": "01744f02e81409de802cc4debf83e5fd6dd825061b912411331e812dca3300ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233364, "uuid": "37b4e9c5-540d-4e68-b2dd-90ffe07d0959", "comment": "Malware payload (Mirai)", "value": "e6369ce5156893be46dde2515516a243a5747555", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233364, "uuid": "92bd120e-abba-486d-b6c9-de29500fd237", "comment": "Malware payload (Mirai)", "value": "1c38568764967fe31abc110d00bbb871dd0979bf9ab14bfebe829592130fa8652677ad9a4299cb9219fa8a605a2cd068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233364, "uuid": "c951ae35-9152-4917-a2ce-eeea13b35100", "value": "T1EC531A92FC434A2BC1D402B6B5BE5A8D376123F9D1CB7227DD214B407BC591F0DAAEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233364, "uuid": "16ba5ba2-45a3-4ca9-a138-77b165db8368", "value": "1536:I4v8DrAJ9yYPw4+960GgVfkRqcxHHmc1cE4sLxe2IymQY2AUm6hh1Z/C/C:IE8DrU9Do4hHq6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233364, "uuid": "623f2327-815a-42e2-8f4c-dd98b6ba56ac", "value": 63816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233364, "uuid": "5072a406-21fd-4d96-883e-aefb621315f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233364, "uuid": "3cdd069b-bd53-461f-852f-51d55581b2db", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841e769c-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292043, "uuid": "3679f3c2-d853-4a20-8077-5870822025cc", "comment": "Malware payload (Mirai)", "value": "912c3c36a3ce4296a28b1bf0097cfffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292043, "uuid": "69d37890-a4df-4c79-a726-1ea86003dd93", "comment": "Malware payload (Mirai)", "value": "01e6c001067d98ca0b6e95e912541e985fa00ad5b994dbbaccdb760994fe44b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292043, "uuid": "14325b65-e667-4197-9a8a-309c3218724d", "comment": "Malware payload (Mirai)", "value": "b81be6d4d157bb80286c74e82479cf5e1cacf10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292043, "uuid": "1018d4c2-1462-44c8-abad-f2c8bcc304bf", "comment": "Malware payload (Mirai)", "value": "22ed2100cabd92c7034a7cf5610a550925cf859353e3530cc7756a1d62f5a3b95d59a68f082feab8ceb2ed115df2fe55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292043, "uuid": "1d1c044d-031e-40c2-8bb6-2789b9c5c568", "value": "T1B4F37DC6E783D0FAEC5205711077BB369A73D53F202BDA43D7B95A32EC11641C61A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292043, "uuid": "f42ab52a-d20d-4cff-83ba-9f421cb3f198", "value": "3072:9OQ70Jtra43AMc/lM+FG5DsHE4XC3ftWM2Wnw3+mgn7ZhIB1T5:AQ709a4m/lM+FGTZ3fFrw3+mgn7e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292043, "uuid": "7d3d56d7-9049-485a-8a3c-857df7083e70", "value": 166596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292043, "uuid": "297c8255-b2a7-40aa-a4de-dcbb53e1ac65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292043, "uuid": "cc98fabf-e518-47e6-8431-29948ac3c5b8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e9665-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226808, "uuid": "1d08f49f-d5b3-40fe-a3aa-7dc570faa5ba", "comment": "Malware payload (Mirai)", "value": "eb9a2b7cd6cfbc13f5999c3cd1a2b603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226808, "uuid": "39e2cca0-94dc-47bd-aedc-bbaad5694493", "comment": "Malware payload (Mirai)", "value": "0224f821b5ab1ae3de322e7d3d69c61ccac50d607a570f505305c4717fb68d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226808, "uuid": "cf48cf19-6653-4fae-bd14-6d662b64a106", "comment": "Malware payload (Mirai)", "value": "a864bf630a0d58134f00daa7213d2ea64e2f68a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226808, "uuid": "888bbfff-67c8-49c3-abcb-04987310258f", "comment": "Malware payload (Mirai)", "value": "6f813ff92b12e3177e18457a6857dc0aa9d3efcf7352c55814026d0bdf39403a07a0fb6bb69ee20c22fdf3cf125e4d0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226808, "uuid": "d601af50-a390-45b3-9aec-5216e913c978", "value": "T100E31945BC81AF10C6D256BBFE4F428A331357A8E3EE7212DE141F2437CA95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226808, "uuid": "5cf6db06-d29f-4310-bc8e-3600dc282f68", "value": "3072:FfCGv0txLHVynmVWsczmLOJhAPrVxqtCO2HOaOiAN/ZojTb/OF2Rk+z/J/nTE:tCGstxz8nmVWXzmLOJuPLqtCOiOaOiAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226808, "uuid": "73bae6d9-557b-475f-b226-412d7e6881a2", "value": 145720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226808, "uuid": "8308b1bb-5933-4266-8489-c78de1a07d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226808, "uuid": "5fdfa7ee-ef6e-44df-ac51-3e532e891b92", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf8498e-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295896, "uuid": "87cf82ee-e8bc-4810-a182-3b537a84986a", "comment": "Malware payload", "value": "435e8d036a192bde5a144b6e816d54ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295896, "uuid": "f38da5d3-64db-45f5-af3d-2f9811ec892a", "comment": "Malware payload", "value": "02713f057c41c5f86bdccb7317aef15fd990b07028e065637c244fb7d4749424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295896, "uuid": "3fe28696-2e33-4205-a62f-f3f92371ca79", "comment": "Malware payload", "value": "5f53db12e6809a660da512a032f5814ee21da07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295896, "uuid": "ed91ea26-2d9e-48dc-bbe3-20455ed184ec", "comment": "Malware payload", "value": "82455b2d7a6fcf05d717a077d0c93816a8e26fd8ff12fcc52df821734881eb3ac8cafa12de0aa686c578c32fbe735fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295896, "uuid": "3fcaf241-5bbb-47c9-ae11-309576332b5d", "value": "T19408336171A0003FCDB6AFB146359E3121BAAC724EB6203FA7D4147FADE0B542D6F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295896, "uuid": "6defbda6-0971-462d-b253-a2bd20be9c84", "value": "7c482157a3760700ddc19ef416e52dc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295896, "uuid": "01a11722-2cd4-4103-98f3-f6f30cd8a4bb", "value": "1572864:CP+i4tWnEmPHjR5z/bm8BmhmXvBF6RTSWraXuNdz7Sz:m+i4tWnPnHFmymOW0uNdzmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295896, "uuid": "af04b4fe-2d48-43e3-a170-de01e17ec448", "value": 83423632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295896, "uuid": "6bfe3440-c727-4521-8680-b7974ba4e384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295896, "uuid": "14a7e169-07e9-46c6-ab9a-5bc4db52656e", "value": "DriverTalent_2222_10_1_33_88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cc6637-e73d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767291113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291113, "uuid": "39274272-b0ca-482a-bda1-5a78683dd557", "comment": "Malware payload", "value": "3e2317b45a46c8d62f5db410c25b9730", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291113, "uuid": "8f84118b-01f6-40c1-afbf-3350f63bb951", "comment": "Malware payload", "value": "02e06110d8f2c08868d7d912f0e8ffe24fd31a238c620f4c3ee278560e8ea70e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291113, "uuid": "3c101512-9f1f-497b-9b58-8f0e20ebf754", "comment": "Malware payload", "value": "111baf72be676d6639bcf9c44a976c22932ce585", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291113, "uuid": "f24b3603-0068-4c69-a8d7-4d17d0d95522", "comment": "Malware payload", "value": "9eebdc8b35239587955b9135fa1f57b5b4286d27aea817a8b196b5b2fed3b419fa79f3e4a4d35012c0e9449a16a73294", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291113, "uuid": "3c92f754-e112-4768-b3c3-88fe9d195da4", "value": "T120E1C686ACF72418A417505DCBBEA6187059905B874ACD9CFECC66B8DF0C1A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291113, "uuid": "1a3a9710-e45e-4024-a088-16342ea20bd8", "value": "192:OZhIE/CTK/easL0llHYoHsfOBro2Tc/O9Smy:OB/AcYoHsfO2/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291113, "uuid": "f907467d-50b6-4887-8217-e1ee8568d999", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291113, "uuid": "82b92a70-2af0-4d6f-9f45-bf69287258a4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291113, "uuid": "1ddf1cb7-84af-4081-b756-191597a1bcb4", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d8265a-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226256, "uuid": "2756dfac-8ae3-4382-8c0c-a78577dd4cd5", "comment": "Malware payload (Mirai)", "value": "97a02129bc97ae8581006b5d8cbcf03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226256, "uuid": "6656f02a-d930-4756-be4a-b6169667cd39", "comment": "Malware payload (Mirai)", "value": "02ecaf2058121b17193f9fb711f5ecd4c4700b6007751fa30fa24a13fa9ca486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226256, "uuid": "1ba74aff-d932-4272-ab73-f4a0117d2d08", "comment": "Malware payload (Mirai)", "value": "efa97592b7e012b5dc09a6bd54921e86f579dae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226256, "uuid": "bf1fdf1f-2056-4b60-8501-96afd7356c8c", "comment": "Malware payload (Mirai)", "value": "95125a7bffe247200588358ff2b90220f994e17d5c6970eeb19676123704e16cb1994a5049a9e9a2320457692a9e9b7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226256, "uuid": "38995491-b6f9-4de3-811d-163ba3e1ac4f", "value": "T11C136C228679DD68E51D89F575348B394B67E201E38B2FFA2619E114C043EACF64E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226256, "uuid": "5bbc3c8b-a245-436f-94ef-7cb589671af8", "value": "768:csh3dKTrdpapvwBLjDZSYP7FSiEkjjUcCJH5CToIOmCH/4u+7R:cseXdeYBGM/Uck5CkfmCH/4u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226256, "uuid": "b4a42872-48be-4da2-adc4-4bf0d5183e56", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226256, "uuid": "13985527-1fae-44a5-afe5-aebf7109545d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226256, "uuid": "a760d162-2e1f-42fa-8fbb-e3c4026e7b41", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc60770-e721-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1767279228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279228, "uuid": "494caba9-70ad-4374-9576-aa14e9e7d2f6", "comment": "Malware payload (ScarfaceStealer)", "value": "2977d7fd9592d2bf3f7f17d94be5d67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279228, "uuid": "f96fb800-7fb1-4aa5-a168-fda992b5ae28", "comment": "Malware payload (ScarfaceStealer)", "value": "02f4e7a4b21815565cf2f631a34c42891569a5a01ca3ac66307235e3a72c19eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279228, "uuid": "28fe60d6-e0d0-4150-83b0-71f3d9adaaf2", "comment": "Malware payload (ScarfaceStealer)", "value": "858ce744e7a464c19725a8d87fec8627366bea02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279228, "uuid": "5a000957-d558-4a9b-8189-7b8ae0476b72", "comment": "Malware payload (ScarfaceStealer)", "value": "290e8721eb72c18f50fffa9dad1b0270cf64d1f68f07ef75bc249561d9adc0acad405724e067cdde912fff7157dd4dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279228, "uuid": "a75df0d9-c85f-4f25-a813-ada7831abfb9", "value": "T1B00723C75EEA93DDD4830F346AC6138825D47289C0FB8A6D3DCF4C0AB156E5A84CD6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279228, "uuid": "69921894-371a-4626-aced-5004c20cec52", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279228, "uuid": "d8dea70b-1d6d-4b0c-90bb-9d2df0ceed46", "value": "393216:T6NN/exuufO7l1nQz1tjQBMPHOQ8uTTI:2jexuufeQzzjKMv/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279228, "uuid": "6270881d-1b6c-4e45-a78a-afca71798fd8", "value": 17375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279228, "uuid": "19e4ff72-dca7-42e4-8191-1f9788754a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279228, "uuid": "5958cb58-6cc6-4380-8bc8-a6385779861c", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6baadc3-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227354, "uuid": "a928fe35-bf4e-4d83-85b3-b2b27c25ee82", "comment": "Malware payload (Mirai)", "value": "a1456ff3ef308932f759943b4c70ee32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227354, "uuid": "67013bad-8f4e-42df-a07a-f2ae635db2e9", "comment": "Malware payload (Mirai)", "value": "02fefc4485650068cb7d03180b0b4b4c2312e5ff5f1b73cb0230f1ae37235efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227354, "uuid": "fa96ed2d-4bb0-41b3-8c58-e0dcf53f2e3f", "comment": "Malware payload (Mirai)", "value": "0805ba09a390016ab7bdc0648c59a9334a15589a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227354, "uuid": "47ba5c4e-3822-4e7b-8788-3680c1a8e52a", "comment": "Malware payload (Mirai)", "value": "b5d266ac9b2fea6f3bf4b91b9fd9081973cf2c209a517d8625d0011afa3e7972990d1fe28db099898c9b439c411f8b27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227354, "uuid": "8cdeeac2-44b3-428b-9027-7a6289025bb2", "value": "T129D32945F8515F23C6D622BBFB5E428D3B2A17D8D2EE7203D9255F20378B85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227354, "uuid": "3f8253ae-2233-42be-9227-5f8bd6b2ffe8", "value": "3072:6VLAFHeib9U8SlGZ24d/mUtJE6sXSpF2:6V0falgI4dOUtq6KSpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227354, "uuid": "a5b7bf44-ef39-46f2-91b1-cc0344302afa", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227354, "uuid": "1f739c9f-3734-4cb7-a2fb-4bfdbfc8efd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227354, "uuid": "182866d3-3a7b-4090-8de8-1bfc37f61f6b", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3920116-e6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251347, "uuid": "f2c77d1e-6be9-4d09-9d6d-67b843aaaed0", "comment": "Malware payload (Mirai)", "value": "34d33e93379ced4e1e1a9e819fcecb84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251347, "uuid": "c8f8a4cd-88d2-49a8-9b9b-312a90ea238d", "comment": "Malware payload (Mirai)", "value": "0312cf75ee04e34951e76aa402fab10fdfb9db5af4d811d0754a1576f4d7ff27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251347, "uuid": "c499ddc9-804e-4f70-884d-a55411d8c8ac", "comment": "Malware payload (Mirai)", "value": "c3f0549c88cf96e6e467c6f3d9cd4d8ed7a54106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251347, "uuid": "eaa3c63f-e95f-4bef-92a5-30839630592a", "comment": "Malware payload (Mirai)", "value": "fb155fe058eb0a1db61944da48ec4e21e98457a3d96f74c236bc0a29b8d01de5a7610646e9288c17d43dc708e445992d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251347, "uuid": "2ffd0753-5fb8-461f-981f-95265a96fba0", "value": "T13882C032111BFEA2C0B051BDFEB5C5C1736702BC42E6B6E223245A265EC157B52DB8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251347, "uuid": "83d06531-d60d-4cb4-9e03-c01da5a033b2", "value": "384:0v+xPXsKazdFTaj5x1Ompiz9CI7tO9wCVHEhymdGUop5htU:DrudFWj5xdpiz9CO49zks3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251347, "uuid": "704b078c-d2ad-4e65-99ea-c4ea9c91bc67", "value": 19280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251347, "uuid": "e488d695-2acc-4356-9604-1a810bfa3537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251347, "uuid": "9f2ce812-7f17-4be0-b51b-f1e945595b59", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31081077-e761-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767306506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767306506, "uuid": "a915c456-1d9f-457b-82d9-e7f4f52ed2d1", "comment": "Malware payload (Mirai)", "value": "bc25a63d139c5bbd355e9dc655973606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767306506, "uuid": "6baefd2d-b143-411d-bc76-d259dd912208", "comment": "Malware payload (Mirai)", "value": "0370be250a520db9f9a54f259676d957d57ef62d390a1c4a6d5abf5d48eb43e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767306506, "uuid": "529b82e6-411b-4584-a012-cd8179a5a2c7", "comment": "Malware payload (Mirai)", "value": "3d297f5f9576a6a9f8c6011f26a420b1e8d14b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767306506, "uuid": "fab3c469-1592-4757-aeed-cbfb759b8d87", "comment": "Malware payload (Mirai)", "value": "d0836205ef051a2d7f3d8ba4ce950204d24c8fa400f3da88e0e10e67a35c7a0bdc6926c3b0aa901353a95c89d81991ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767306506, "uuid": "3ff2566e-7f12-43d2-8f15-e10145f6b0b1", "value": "T115535C96B405DF3CFC1AE67BC1120A06F624374596830F3FA7AAFC935DB12988D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767306506, "uuid": "a0d76d02-39e4-4429-a0ca-d167c332ea43", "value": "1536:1C7aP7ml6oIYb7BrvsLE4HBd+2qn68t755xSPAQ1JaDPG:1C7Cy1Rr0Ln+d57kPn6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767306506, "uuid": "8440c5f2-4e36-4da1-b000-1aff3e5014b8", "value": 64220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767306506, "uuid": "2c1e5038-4e11-4bcc-b451-a8af1149e265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767306506, "uuid": "fd9e5f18-15fd-4e72-8871-b2a3687d6526", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df153eba-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295631, "uuid": "fb2f536e-3102-430c-baa6-6376b1cee10f", "comment": "Malware payload (Mirai)", "value": "9534cfbf936ab468d449cb6dd2fb3c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295631, "uuid": "876c3dea-0a82-410f-a698-d068e1e219d6", "comment": "Malware payload (Mirai)", "value": "038fd7aa00a0f9974f2c860a167d95954d01336e5a2709cf69692d2e899abd6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295631, "uuid": "bdae007e-1b82-41c4-9519-3d17121ee229", "comment": "Malware payload (Mirai)", "value": "c629ed16419f3142d1df7ba81252d0b4c9f41b91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295631, "uuid": "02d4f9bd-1d06-4864-aed9-a4a06fc1e0dd", "comment": "Malware payload (Mirai)", "value": "440b0b49c751a33879794642e26d18707eea42e69aaf2ba25ab448c68164e0598fac409dbb1c7622673163287f8af469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295631, "uuid": "ddaf5d7e-5601-4e1a-b16e-06c6a0637b0c", "value": "T1E87302527036B4F0879168279254FF873D09E7F2C929A531E1A2DB3EBA4215707D06DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295631, "uuid": "1d20c037-a8b4-4bc0-9a1b-87ef3ea29f46", "value": "1536:idXsowBbGcDMzRRE1gP087L7JCtZaIZQ5QR3tackT2JjZ58xAaMFu0oL5:i/wBbDeRREy3t6Q/cm2P58dMFu/L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295631, "uuid": "3027ada1-7413-453f-a989-e09f41ba0106", "value": 78024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295631, "uuid": "fc11dc3c-42ea-40c0-b5c2-6a2cfe24b742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295631, "uuid": "a63bd42f-a96b-48d8-b570-756a3ede90ac", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf82256d-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226430, "uuid": "65af49b3-bbf2-41aa-976c-7e28f342978f", "comment": "Malware payload (Mirai)", "value": "1b866edcaa4afb435dab17ad4946c782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226430, "uuid": "811c5f57-6c90-424f-a39c-fdeef49b5e4e", "comment": "Malware payload (Mirai)", "value": "0545468f83b3cacb89c321725ca8ae6ac3a0cbd94de1cee15011d22882d3beb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226430, "uuid": "f20015b6-8873-4108-a618-f7573a584353", "comment": "Malware payload (Mirai)", "value": "bb6866c55b3021735cd6fdb920bf4c77352ef1e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226430, "uuid": "cd318df5-bbc6-4772-a3ed-e603662fd2ef", "comment": "Malware payload (Mirai)", "value": "d92ee0617c0da8f338350428164fbaf5a32d5368eb3a647af5b136867a61a318426928eba3f29ef95f54613262d591f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226430, "uuid": "a0e3aff6-c165-45e6-9aff-46b0f023ee8e", "value": "T1BA436D86E409DD3CFD5AF67BC41A0E04F5287351A6830F27A7A6FCA35D731689817D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226430, "uuid": "692249f2-a699-459b-84d3-d5d92545dcf1", "value": "1536:IXeDAYUI9ZunyFlsdES4fCnMMM8SvbtMHdTKGZPm:IXaAYU0lsdKfCFkCHhXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226430, "uuid": "9981b191-9702-4f47-9ec9-3e28fa396b9a", "value": 58684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226430, "uuid": "c50f4005-c854-4062-8a35-d02186054864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226430, "uuid": "c97d2018-1f3b-4d43-b3a4-35748420bbc1", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e839b40e-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233370, "uuid": "0a087d8a-0394-4934-b73d-bd4c0a5d2804", "comment": "Malware payload (Mirai)", "value": "c6a93d3cc424ba98ea3a097aec088c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233370, "uuid": "9646b244-ba23-4e2b-b7cc-adf8bd6ba4ee", "comment": "Malware payload (Mirai)", "value": "062075bc9cfa1ae29ad6f2ed23d04ee03270d11804ef30ca31cfb05e1ab32e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233370, "uuid": "ffba8364-1170-463a-ba6d-1293e7dd1ff9", "comment": "Malware payload (Mirai)", "value": "b4a7a5a2651595bef20abfa57130de4d755d8c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233370, "uuid": "d2475e31-dca5-4eaf-a69f-93a1998c47ac", "comment": "Malware payload (Mirai)", "value": "615ca6eaa552d15df20924d4989e7fac25813e67d6bd6c98018635c314ec85736d1770f12b9ba7e299120e8b1d88054f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233370, "uuid": "84a4b72c-3888-45e8-a46f-2c50e7305542", "value": "T1DFC36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1901D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233370, "uuid": "fd12d41b-5b8c-47cf-af14-f09657e7bd14", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeQ59tQMceGM5UQ30hAB1E3:Zr4KEKcHmz2F4edeOQ3G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233370, "uuid": "344c774f-3532-4988-9fdf-fe15ee90c9f5", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233370, "uuid": "2e975658-192d-45c3-8a20-43bfeadf56ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233370, "uuid": "5483f520-f6d9-4b9a-81bc-245175b6a823", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b50e85d-e73e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291652, "uuid": "1e42282e-4a83-4fd3-92f6-dee590f390e6", "comment": "Malware payload (Mirai)", "value": "b4ac1e08cb7c0a44d173d2f9c1c46e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291652, "uuid": "cfea2ba8-bcdb-4db8-a131-9c4a1c12a295", "comment": "Malware payload (Mirai)", "value": "075c75e5d13ae917ddc8c70090689062740eebf8d385479c59029759b47a1742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291652, "uuid": "836bf6f3-87f7-4eb8-841b-0785abe717f6", "comment": "Malware payload (Mirai)", "value": "db055655bb246d8e968543232862dba6c8d94bf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291652, "uuid": "c7a194b5-02a4-48d9-916c-114a81656387", "comment": "Malware payload (Mirai)", "value": "e0039b1b2d665b4fffb64e638e0479261c7798f0c77ed8a94c3a74bcfd380473dabecef93276f203f7c9939e9c178c4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291652, "uuid": "92b02175-fa69-444b-b033-06ae2d813d05", "value": "T145632957BC829B11D5C512BAFE0E514E33231B7CE3DE72129D24AB2077C69AB0E7B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291652, "uuid": "1e008039-f3a8-42c7-b79e-65fe364bdecb", "value": "1536:COnzcIIqz9Ao/FcaX5mbRKy8azjRotQXMMoi24yHX5DYm:AIIqpAo/iaXaRKy8azK4yHXth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291652, "uuid": "a9e8a4dc-8036-4a3f-babb-3f607392079d", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291652, "uuid": "0eb21104-1930-41b7-a799-3fb7342d6d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291652, "uuid": "041d4eed-2622-4e19-a205-4822ac3c9d66", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a1c087-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229049, "uuid": "0775df46-78a7-4d93-86f2-8b21ea1f10bc", "comment": "Malware payload (Mirai)", "value": "289410c92595288ddaea6ebbe6f81299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229049, "uuid": "0bed5dab-b921-4746-aa03-809d087658bc", "comment": "Malware payload (Mirai)", "value": "077f4a5659bfb292e9fff876b5fc78cd6cf3300e13952379a5eaeebf42e80fca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229049, "uuid": "7ad98c3c-e193-4a5f-acf8-22754730fac8", "comment": "Malware payload (Mirai)", "value": "7c6a3c25b0a339445a08a9998c48fa3088830320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229049, "uuid": "83d7bfdc-4341-4e0f-a0d1-9b2c432ae683", "comment": "Malware payload (Mirai)", "value": "0ed56fae2d9c21e25e6d4bf79365860ae15878913298fb2d5f9c69f8430a099517241ca6f027a7aa1a77064d509d5dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229049, "uuid": "f9437ea3-c8ee-4973-a3c5-10933b8b13f3", "value": "T10A03F22250C3DC729BF16834DEAEC08AB3756A68D2D5713A310022AD8FE5F1197F5F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229049, "uuid": "da0957fc-8139-4558-a7db-647cac204d37", "value": "768:e6bgl0/gWtoDfoe9l6pmzHllY8ToAJTDVsvzXMyQDs3UozbD:ea/0t9lvHlZyzXvQuzbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229049, "uuid": "97cb95cb-052d-46fb-bc96-918f0576139d", "value": 39140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229049, "uuid": "04bf7eb0-1db7-4656-b827-07ff7d146f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229049, "uuid": "b06bae03-796c-4a0b-886b-3302007c6c0b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a890fd4-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295436, "uuid": "e1f8abbb-f15b-4c4c-b29a-224e5a781eae", "comment": "Malware payload (Mirai)", "value": "27815425fa4a3080ded735af3f97cce8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295436, "uuid": "97e400b7-4a44-462d-890d-5883e1071135", "comment": "Malware payload (Mirai)", "value": "0974bf8c04aba747a6df958efbb8168a9749f7303070502adfc44b0ff727f719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295436, "uuid": "b628d25b-be86-4930-a1ca-0c16e2536ecf", "comment": "Malware payload (Mirai)", "value": "dad26fe80f3390f69a9b93271d00a429a3f1eea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295436, "uuid": "abb1121e-9f4b-4aaf-9554-f0a1fcd42760", "comment": "Malware payload (Mirai)", "value": "da700a56efbf0fd080f0f27b6ac3fa00d161199ca9d07e3d9f12f1235026f8eb0e50032aeec12999e04aba1cdd0dacf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295436, "uuid": "ecebc3dd-7a69-49e2-8626-9dbd71f3cb6e", "value": "T111B3C95E6E218FBDF769C33547B78A21A75833C623E1C685E16CD6005F6028E542FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295436, "uuid": "dc8b5892-ff7c-45f8-8313-2fd72bdfb0f9", "value": "1536:5Zzd/fQAm8rJfymREwF50RMJxIRZzMN3XqwMYeTNqec1/T:zd/fnm8UGP50R6IRZMnHM5c17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295436, "uuid": "db2fb148-ef34-4b9c-bf45-3ff2325e195c", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295436, "uuid": "41be3853-3460-4d3d-b36e-65caf98dc2b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295436, "uuid": "34815144-c2bb-47c3-8704-a379ace8dcac", "value": "goon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f51f8d-e713-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273175, "uuid": "b0718b54-b6d4-49a5-ad89-ee9f6ebe7352", "comment": "Malware payload", "value": "a3de7b48684d6acdf74e4ffeebdf3f68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273175, "uuid": "50c02109-3607-40fd-ae12-bbd0e41147b4", "comment": "Malware payload", "value": "097d55d24f679de9d0483f3ddec223eb7b13c3f62bba5a81cda62a6604e2d578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273175, "uuid": "057d793e-ffe9-4219-a370-e34d4c95ca2f", "comment": "Malware payload", "value": "b8c7477b56035dd575c35baf3f21207dfac8ab92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273175, "uuid": "6ff3cf45-8e65-4c0c-bb4d-674383649891", "comment": "Malware payload", "value": "2ba54dab290252b500d6b9fff25e255b5ece6773dcdc15108d135edcdb7f694983ec017e5748d487eb4d612a044042a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273175, "uuid": "151ce083-413f-403b-adfa-c1be485acc63", "value": "T166E2F11ED4A8AD53C65F6DBDA0CC0B768D49B84673192E128312874DEF16E8F9E160FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273175, "uuid": "2e3b10e1-9065-444a-bee8-067135a55d32", "value": "768:u4YuDs1kBBZ2FtxdHJMTSEd5rXsLbWZ5G:u4UAZicSE5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273175, "uuid": "220ad672-deef-47dc-8e9b-ee296f77263e", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273175, "uuid": "9f656b1c-f747-4ce6-be19-61570c894476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273175, "uuid": "c9230a33-5a96-4e65-a078-f0b9fd5d7d06", "value": "xans.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097e7e36-e714-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273369, "uuid": "838bfe7f-12b3-4eac-a6c7-cbed6dda636c", "comment": "Malware payload", "value": "e6714daccdb6192d2158c95ac1879e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273369, "uuid": "52d48ddf-4c1e-4b14-92f7-0c88d24a1019", "comment": "Malware payload", "value": "09f6d64b2750880227a9c2622679519f0aadfef26c158ace43b544498ac5ca6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273369, "uuid": "0a1bf734-82ab-492c-b181-cb9840802b02", "comment": "Malware payload", "value": "23f708ad790779e88c8e94e15534bd1f88e6eedb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273369, "uuid": "cc17e3b0-f553-445c-b750-b2afe0bb6df6", "comment": "Malware payload", "value": "2d55559abddb580f1d648b484e654e859f1f2bec91339d12ef1b83020cbd676b58c9de7b9fb936060b6227bb5c63d98f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273369, "uuid": "b21099ca-fc9f-44f0-a59e-abc666524e9a", "value": "T1EB35238CF8CF7C52EAEF88DEE34913894703EC5DC95498E311236A71A122F78BE26555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273369, "uuid": "64dd4068-7ba1-4d7e-a858-61b8bc16bb4a", "value": "24576:VC3SCD5aVjKXpb9KyHK7nIgJtTpYIHzpquVF2TFl2w4rnglV6U:VTCNmjK5bBKLIgJtTWWz48F25l2w4rnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273369, "uuid": "49a3aa7c-6737-48c0-81f1-f1bec19e07ea", "value": 1096263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273369, "uuid": "6d368b7a-f12f-4bc9-b306-9daf55c45f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273369, "uuid": "931abc86-7e3c-41f8-89c4-bf457c89e300", "value": "bizy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1f1225-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767282980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282980, "uuid": "7bb24872-acfe-462a-b83b-de742db6c3da", "comment": "Malware payload (MaskGramStealer)", "value": "f16395e5da254e14c45e54afb0f81313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282980, "uuid": "eca9a740-8d26-4cf2-baca-f4af4ea7585e", "comment": "Malware payload (MaskGramStealer)", "value": "0a560b651255651e75d8753d3835bae0c1334125e2dada42271e89dd256d069c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282980, "uuid": "b19f318b-5ac4-498f-bf6e-95e025e20e5c", "comment": "Malware payload (MaskGramStealer)", "value": "7f10904e1a8798d42f0638a3872a2a0213bfec61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282980, "uuid": "769f117e-680d-4f42-a936-9404be54dd97", "comment": "Malware payload (MaskGramStealer)", "value": "3c3d881fde055fc5938e58f86f21e92de2024a7207e3e82e66816d63a34d6daa4511d2cd3d97c5d37b27f041f887f5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282980, "uuid": "fd0e766f-c628-40f3-8c16-37e3bfed2d52", "value": "T16C24026E0576EB8DFAECEDB4E0115EA2D850392DCD56D2A3CD75E66033724C80E8E6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282980, "uuid": "21c2c2e8-e8c4-428e-8641-80bd218f83d5", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282980, "uuid": "c2102d85-7f99-46de-ba7c-730eb6d1441b", "value": "6144:d/8yeyQqFz9qafAKaT9YZU8CePkzrrlXX:syQql9qafAKaT4FC8k1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282980, "uuid": "62143c2e-e19d-4194-b78b-1c8f9247a849", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282980, "uuid": "177eb07a-9214-4744-805f-cdd41475448c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282980, "uuid": "5e43e140-b5eb-4bde-bc10-b91772499112", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4f180-e6b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Ligolo)", "timestamp": 1767230984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230984, "uuid": "44996e6e-9248-4fd6-8d75-26bca1f8f1bf", "comment": "Malware payload (Ligolo)", "value": "50c07df13d2f922186d9c50d636d08ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230984, "uuid": "9b91a77b-48fa-4715-9004-d2feb5b8d983", "comment": "Malware payload (Ligolo)", "value": "0b74e5aa8e84ddefd60a6663e6305b3615eb743db543323f8a0068b58d56503f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230984, "uuid": "fa0cad84-dbc8-4550-af7d-5e5f6884c768", "comment": "Malware payload (Ligolo)", "value": "b587f8daa51a09d3409a8ee85f7a71a3351472ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230984, "uuid": "8d24c178-ea1e-4188-b625-cfb614c0478b", "comment": "Malware payload (Ligolo)", "value": "b6bc6d189debe15ceb0b51420ff8157a859ad13976cf4bc5c86c8bbc2a4004817b5c81f53ffb3a149100fce0034e026d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230984, "uuid": "df5e94dd-7243-48d3-89ea-bd3812674720", "value": "T17E768D13EC9159AAC0AAF23189729253BA71BC452B3227C72F90F7382F737D05A79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230984, "uuid": "9ff03ae4-6def-451d-8b08-ebabcc9b2af3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230984, "uuid": "386040c1-e209-4267-bf9a-0e93a1a3924b", "value": "98304:fOjo5IXAIYIZfV3eEIlUZznde9FCrSrOW2:fOjoIXDJ7IC7de9olW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230984, "uuid": "fc5ae9cf-62f2-44d9-b927-49010d157230", "value": 7192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230984, "uuid": "b5914819-1bd3-4d0d-9ddd-d5f64f1e565f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230984, "uuid": "be85212a-ce68-4074-8a53-98a62cbbbbb2", "value": "SecuriteInfo.com.Trojan-PSW.Agent.21666.27519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4062a27-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254784, "uuid": "366c4ea7-1f05-4623-ab6d-215e34acafb4", "comment": "Malware payload (Mirai)", "value": "653c3c43cae5b1a998cc0a151016f0a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254784, "uuid": "272f745c-0043-4f44-be80-0ca3d5f492ad", "comment": "Malware payload (Mirai)", "value": "0c1d197ae86caf0ffdd1ca5574a62b11178e1119fc6720a549888561ba1a3604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254784, "uuid": "97821c88-a06c-4271-bbc1-98e78a55d05c", "comment": "Malware payload (Mirai)", "value": "cd98ffbab0febc2427347ff18483547a6962ad47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254784, "uuid": "c0646192-0344-4d6a-a2db-ac62b520d3f0", "comment": "Malware payload (Mirai)", "value": "04acf312ac6bacce2d883915d00704e3926a06cb31dab3f0f2feab1d6f2b2256bd6a2188a752cff0b5981018990d186b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254784, "uuid": "970f434b-d4a0-4d02-bea8-a5bd9a07111a", "value": "T1A4834B41B3480D43D1A75EB42A3F37E593EBD59021E0BA89650F9A4681B6EF3154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254784, "uuid": "5218c81d-1781-4539-9660-bee97d91f9ca", "value": "768:dRkw845lacso0c/nH1l1mnhOzbRjACThTw/eNV9xwI3Jw/68INFAr+xFkmtvdHmq:TZbPOIe0zN7xXP8uF++Qm9dHmzhIT8Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254784, "uuid": "7a21f462-a089-497f-a1eb-f4154bb03271", "value": 88600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254784, "uuid": "5ac5f11a-9f11-4fb6-8a8f-29852d58e627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254784, "uuid": "1c55e402-9e0c-48fb-bca3-81414b78504a", "value": "m9x7k2v8b3.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d394a93-e746-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294930, "uuid": "389036a2-c50d-407f-b0a9-bc29d19918a3", "comment": "Malware payload (Mirai)", "value": "3c40bd4f38eed505707c7570827c0d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294930, "uuid": "541670b5-a61f-411a-93bd-1d86af8357fc", "comment": "Malware payload (Mirai)", "value": "0c21f4f74df78227cb0967d93e0028db61d91bd52b72ba62da3de636527a6b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294930, "uuid": "8d79dc57-2902-45bd-8bdd-cd6bffae9364", "comment": "Malware payload (Mirai)", "value": "30a093b18527459412f56dfe462ab2a78d850c04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294930, "uuid": "fec7d66b-a434-4fba-b620-5f1baff050da", "comment": "Malware payload (Mirai)", "value": "5f31e1ffd82028702daa7a36f9744ee179ed50a7438bc1b6f038c284d13b3b826eacbd0f6f46f5dde476f452de29cea3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294930, "uuid": "2647e75e-3701-474f-8214-45fab1b1308d", "value": "T136F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294930, "uuid": "6e5dafa5-a381-4865-ba25-b01bdb1e4134", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHCfam:9FJMgWPZr8IaCWReS1WpPeP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294930, "uuid": "65189e03-d2a6-4634-9520-de8f1ecdb0ba", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294930, "uuid": "f4b61638-39a1-4747-9d09-c9e3e92ec8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294930, "uuid": "7d48a6b5-2c1b-420b-9b6f-731ab4856096", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d89976a-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227554, "uuid": "b8cbcb59-c4f0-44e8-b9e2-b23717139633", "comment": "Malware payload (Mirai)", "value": "04a9c9d005ab8f817b48d843fce1e90a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227554, "uuid": "0d7b3a19-bc83-4134-a7ed-6ff05bac050f", "comment": "Malware payload (Mirai)", "value": "0c77c072177644374c202a2623e49bcd25a9d6a3712c0898e81bbede2c729dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227554, "uuid": "97fac099-3ad5-42bb-bfe1-bd5eaa0e5919", "comment": "Malware payload (Mirai)", "value": "b4a2ed489d82f2081fb2150a73f4d2a29adeaadf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227554, "uuid": "d8703db2-5a77-4f9b-8718-259289c971bd", "comment": "Malware payload (Mirai)", "value": "e4429619c4ef5c84f0c05bbedfae24651b7f0eb11fca5d27a8f95516b3c47b1aef302c79a24132604a7dc2c80e657b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227554, "uuid": "661d8f88-e557-443a-bb66-d0dad93f24c0", "value": "T1CC232944BC819A23C6E4127BFA6E018D372563F8E2EF7217DD215F15778A82B0DBB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227554, "uuid": "af59000b-6726-469e-bb29-5dee4489b366", "value": "768:uiPl/XCZ97mbobA5xa74L0uIwUS+3FtP3Uq7VN+ghTdFgu:TlfC6xaA0pxS+/PP75iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227554, "uuid": "1c8d3166-5bb2-4380-b932-ccda5ef9af7a", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227554, "uuid": "471463d0-f359-4dbf-883c-9a791ed4dd9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227554, "uuid": "1dc7bef8-22de-4c79-a774-a3957e716ac4", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20578ac1-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228310, "uuid": "22494bcb-2ca3-427e-acc6-bc088853baaa", "comment": "Malware payload (Mirai)", "value": "5293578fc3b3e3a8b2a091900605a056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228310, "uuid": "957cc8c2-93a5-4ba9-b569-c3807a07756b", "comment": "Malware payload (Mirai)", "value": "0c95f320265f59371f5722f1b4a7612c8fd5222f27ac1ee6479920a7c38d65b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228310, "uuid": "0ea2ca28-4b72-4f1e-a397-8ecaa10fe175", "comment": "Malware payload (Mirai)", "value": "c6c2be82b433ae13134a281059c5b054e2f59a1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228310, "uuid": "1ddd7409-91be-4c45-ae16-ac22eac8327b", "comment": "Malware payload (Mirai)", "value": "b970701607821e2c1461cda40f651394628d1849a827ec2ef073de4b2dc30322d6d7ee1167d728b9d01f4cfc24c28c50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228310, "uuid": "5e72a31f-f22f-497e-a138-6e02f70bbc12", "value": "T1AE536E4233184A57D1A60AB02D3F1BF183BE96A021F4B3C9B54FAB698575E331086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228310, "uuid": "1624dcf5-2a14-4a51-81cc-f6d538f42ae3", "value": "1536:4bFWUG6/mRupO25+8ojEaIqkKfezHTFHlu+7Rkn:MWTL2087a0HTFFu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228310, "uuid": "dfe54675-d090-40b6-b76d-bc9ddca96cd8", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228310, "uuid": "c65882d4-c94e-47ad-92d2-8040e59eabed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228310, "uuid": "9c84c190-65ab-42c1-9239-e2dbd58c0ed2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e185958-e723-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767279873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279873, "uuid": "d1729860-ac95-4a38-980a-6c7d0ed732fb", "comment": "Malware payload", "value": "95c94b7c3e6b9b4713ae2d1f7ec0aeaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279873, "uuid": "0dac3217-89d9-43f6-8c76-f63c101e5174", "comment": "Malware payload", "value": "0d82fed0448df38816c2941de75f3abea488ec9059b4537cc6e940a56d3b8fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279873, "uuid": "b776da1d-eff5-459b-a440-57fc829e5891", "comment": "Malware payload", "value": "799895744a53b207df90cd93e3c173cf74212292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279873, "uuid": "8fd66178-68a9-4b82-b5d7-5b56e4ff8eaf", "comment": "Malware payload", "value": "9f290501b5c333842a5c987b5720d3542d28ef8c04017111da27772b13db2e1fd9ca88ef6876027e601230fd679bcd0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279873, "uuid": "3023e76a-f0ad-4a5a-a7b5-d27f1929bd56", "value": "T1B2B63313D57BCCF4CB234678D6E10A46BB4A018A9C5AB8D4E584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279873, "uuid": "e5ebc721-d8b6-43a9-a482-273305009463", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279873, "uuid": "d059910c-2a22-43b2-afd7-40a503d33b53", "value": "196608:haZk+wi0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8B:Fni04RT9R4PkE7Ap84p29qIT0Z6rXr8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279873, "uuid": "696f3f72-1953-47d1-9ce9-ef3cf92cc031", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279873, "uuid": "86d0a084-d66f-4332-ab12-b2bb45d2609d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279873, "uuid": "1a8b3df1-f72f-4ac3-ab72-abaca4c41b7a", "value": "RSVPINVITE_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc05e0ee-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767228195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228195, "uuid": "83d7d128-d4f8-4975-ba7f-968ab7f3aacf", "comment": "Malware payload", "value": "5adc623817f16fde8c2afe2d92dd2938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228195, "uuid": "a2266384-0117-4cd1-bc8a-749ecdd03060", "comment": "Malware payload", "value": "0d9211f55a021885ce606126013fc3e1e0b0090ffa8c1596ed7d7ba509d8e5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228195, "uuid": "2eba0c79-1710-41e8-9a71-12788f4beb95", "comment": "Malware payload", "value": "940b02ba3a8c226c700d61c558acaef1dc93dbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228195, "uuid": "251313da-31bf-4baf-b2bf-3b86ba7b2a33", "comment": "Malware payload", "value": "9284de4c535f285972442e55ac615d6c3cb5c9702ea448595649a6567180f274df5ee4a4b0ff49944e9366af5783d51b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228195, "uuid": "50d636d5-88b5-4c7e-b529-85c61ec4fede", "value": "T12AA47B4C6D9DC290D24F11B557231AC3F3A2B928663583A33BC079693D5DBEE8497AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228195, "uuid": "7b29bd52-8709-489b-a03e-e533f0ec5a3b", "value": "4913973a9b40fe50f84dd10a14761784", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228195, "uuid": "b00e6a7c-7bd6-4dd6-aba7-406454028a07", "value": "3072:+JZGfTtVBtgJsVxWafdN8kux4CsEjApIld2G+zhpgDv2vVwAoFaHpkZ9TpoYkGTQ:FdesqQ1vC20df+DgDevuYHG9dBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228195, "uuid": "bff82f50-678a-4dbb-b078-d22eb0760957", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228195, "uuid": "671353ad-b784-49f3-9e60-b4169c116d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228195, "uuid": "7d220b8f-b1c1-4c46-b8ad-dc3ca327e499", "value": "2025\u5e7412\u6708\u4efd\u7b2c2\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79dba61-e721-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767279244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279244, "uuid": "305681c8-e79d-42a2-97f5-26f59c1f9693", "comment": "Malware payload (GCleaner)", "value": "715002d1290a226e34a4a5197998aa82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279244, "uuid": "e310eb9e-f190-4845-8ef9-87899a8738f0", "comment": "Malware payload (GCleaner)", "value": "0dd8c7782b9763c2be731020bdeb1fa36fd0eadb105c21a8fe265724a21ac911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279244, "uuid": "b20933b3-dd22-453b-b4c7-224656877198", "comment": "Malware payload (GCleaner)", "value": "7609dad0e2175b4c9fac073179576238c2b9b5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279244, "uuid": "c8c8b3c2-58fa-453d-8435-5fd326b24dc7", "comment": "Malware payload (GCleaner)", "value": "34978d2580180054d04acdbadf6b947b9979e2cb7dcc305433a05bfcf0a329da25103e2ea55f90f5f95c374ac9718b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279244, "uuid": "42696c20-dad1-4d19-91d1-8cb004de9916", "value": "T1ED36DF19CE585B2DC921B279462F4E48BCDE3A0215CA36CEDFC659FCA631B9251333D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279244, "uuid": "5657b3de-bf5b-4011-aec0-ac6db15c14f4", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279244, "uuid": "7cd4fa0e-45ad-4f8c-90f4-1e9668115c5f", "value": "98304:64nCVr5b/ASbJ3x7CHBW9lSXrSOPs9oAPrrslsi:565DA419G1lPs9oAPrYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279244, "uuid": "4c9cd588-a8f8-4fab-bb90-dc094ef66eec", "value": 5089552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279244, "uuid": "507b1a0f-1dc4-4301-824a-c58f0c4b570d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279244, "uuid": "7fbaaf26-9e30-4f41-933b-b1b552a0c76e", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc936d5-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304568, "uuid": "3c0f794c-b24a-4cc5-9b95-19468b8d81ad", "comment": "Malware payload", "value": "360c351f6eb4ba88147f2e6f67964318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304568, "uuid": "6ce254de-52a1-4b05-8135-10f452af58b9", "comment": "Malware payload", "value": "0f1a9c03fa7bf1525b34406245dd6ec3bf28a1f951b5b80a84732d0f1ac9aefc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304568, "uuid": "28c3dace-f7f1-42a1-8a71-c63ca440014b", "comment": "Malware payload", "value": "a4c0403b395b26a5e38990a56dff4f076154a5e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304568, "uuid": "ed24483d-2951-4df1-ba79-5d38ebc9df23", "comment": "Malware payload", "value": "5a7c56c8e6e63de13845757fc55e125a92816cbf0f5cf7172c4a2a6e704872698da088dc48d6a5660e2ae35dea8ff767", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304568, "uuid": "c9a2ac4c-11dd-40cb-815b-5a8e9c9b215c", "value": "T16B466B81FB08A126D94B0B728CB30B61B3516D46C2E4C92B5309F76F16B26F7694FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304568, "uuid": "d97cf398-ebdd-4dfe-b196-4bd3b62731e4", "value": "98304:oxqTmyR2v72QduBZVvX9hZaDmc0/OygnEjEa:5x2v7pMBZ1sIInfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304568, "uuid": "071a5489-391f-4049-b8ba-3ff8740aba1a", "value": 5701816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304568, "uuid": "fbf2df74-09ba-471d-b0b5-565d440183c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304568, "uuid": "d7ea7451-137c-45ad-94a8-b66863360b1d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a340502d-e741-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767292954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292954, "uuid": "2623410a-c346-4257-811a-f4f0df94f896", "comment": "Malware payload", "value": "6b6d562c71b953f41b6915998f047a30", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292954, "uuid": "dfcd1d58-36cb-4c11-b99e-59bb693bcd7b", "comment": "Malware payload", "value": "0f20b9f81a006b42fc0342e41bd990311ca2089c99a9e19722c830fe1e202eb0", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292954, "uuid": "1a6d8902-99d7-4a82-9d27-a239bcf1b300", "comment": "Malware payload", "value": "a7c9877eb71bccf9031d873b7a67276cffde2774", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292954, "uuid": "d093852b-d3a1-4784-9bae-a20e1bec105b", "comment": "Malware payload", "value": "d688fa1894126de77384b5d35436a8e26eb402ae09e5fa31ad1e13b3d2c44562e8199f512fab39035deba83c550ca0a4", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292954, "uuid": "09b3d134-ba6c-440a-869b-5a33cb3a8d19", "value": "T17D961AFBB222CA58C0CBC6B4A4979BE29B61BC1405B51352A3C7370F6F76C405D998DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292954, "uuid": "9165f83d-7a4c-42af-a639-ce90003a2297", "value": "62cbda1f0a4dcc6fdc7130d3e28c931f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292954, "uuid": "6c3930a8-5aef-4fb0-b91c-9d0210093253", "value": "98304:na3uiw86zxz75lQ1efXL6Qcd7Jd9PW76Lnfiv89:naKzxz1lHXL49P/Ln6v89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292954, "uuid": "174ca76d-d4cf-42d5-a323-d59eb6ef90e8", "value": 9007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292954, "uuid": "18a9daf6-d5dc-49aa-aa5c-77da6521f8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292954, "uuid": "09506a3b-93f9-40b5-ba06-5a736e4f8eeb", "value": "Setuper_KMS-ACTIV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c58766-e712-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272643, "uuid": "1afba0c4-e082-43f1-b829-b8e163ce24ce", "comment": "Malware payload (Mirai)", "value": "07155bbfc9d8d8db62160e84907eeaaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272643, "uuid": "122af4da-f9b5-46b0-bd3c-c4db3d615d7c", "comment": "Malware payload (Mirai)", "value": "0f3898c9a28bada47ca802b770f913e749cce3bec50608753e276a8e1bfb0f55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272643, "uuid": "15beb955-57e3-40bb-a53e-36140ae6887d", "comment": "Malware payload (Mirai)", "value": "efd5738f0b3d0d8546681a190a67cd0ef7e19c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272643, "uuid": "16e8e01b-f625-4be3-a2a5-e2c5fc21d555", "comment": "Malware payload (Mirai)", "value": "c828401a07b576e076d908421546e465d7d065b8e9b07dd5f94090f489ea89b11d7799798a7fa7e46e405df43f1cb5ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272643, "uuid": "da16d696-d840-4d06-9179-ea9bee3c45c1", "value": "T10D047D0277190943F2631CB03A3F2BE5D3ED95D021F4A649395EAB4D9272E366187ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272643, "uuid": "db49c2d7-0457-42bc-9b9a-b27102fd0a73", "value": "3072:EUSvuoTwUdHaXMotmsP9GF/s6FltTlao3zbV1/7iEeLwFk2jOED/H:EUmTjaXMot7P9CE6FfwkD/O7wu2jOW/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272643, "uuid": "89df2966-24da-4584-b538-4e31f1b69f23", "value": 174196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272643, "uuid": "48eb38b8-cdea-47bb-b233-2a3d702c1bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272643, "uuid": "20cfe23d-2ac3-4347-bc0d-2b0d1d7472ef", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eabf4d0-e721-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767279015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279015, "uuid": "675edc0f-e145-4275-91ab-423d4bb5637e", "comment": "Malware payload (GCleaner)", "value": "c833c7db4ca6c360e97ae54c1b946d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279015, "uuid": "4bb81e00-2beb-4f16-b9c5-77ca24f4165e", "comment": "Malware payload (GCleaner)", "value": "0fb5428a57dd4df24c55f00a59b19e4a824d4646fade20d3fb4acf3707ccac25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279015, "uuid": "257283fb-e9d1-4cb0-9b20-b27af6c26780", "comment": "Malware payload (GCleaner)", "value": "3cb431c1a6e49bd11a06132ff49d490f024148ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279015, "uuid": "13682f4c-82f4-49ec-937e-708be2248158", "comment": "Malware payload (GCleaner)", "value": "931e8e452b9c5ebe558b7c18205d466bf1b93588db7c53a60f19444b82c4ff49210e926a51ba7a24dbe9193254a22f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279015, "uuid": "0e4c7db3-a684-42e1-a062-a00aea5ce9cf", "value": "T1BA56E0CC5E7C8D23FEC3F6FA425A82AD6E13E9542E121A2711F90CCB954D053B98D35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279015, "uuid": "f71063c5-8fe2-4298-b902-263deb42eb4d", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279015, "uuid": "3b73790d-1ebe-4f19-a508-5101a895941f", "value": "49152:/4nCVmP96nE5GB4qymI/gQew9W5sfnmJjxrfrGQH2PRrutWnLzkEzW07wtkH8lVN:/4nCV29APyXr/piZH2JyoLzxxTH2VZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279015, "uuid": "c51511b4-d903-46a1-a81a-8fb3b11714db", "value": 6201616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279015, "uuid": "80605b19-cc83-4580-adc5-6be1e5182b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279015, "uuid": "ae0614fe-4f3d-4d6f-bd63-59c8a8df60fc", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a72ebc-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767229413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229413, "uuid": "fed6c201-0d10-472f-907e-b8cbd3436af4", "comment": "Malware payload", "value": "ed12395dbc9167058dda34cb5ee9d773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229413, "uuid": "d91e1168-5a1f-4224-8893-6a03835570fd", "comment": "Malware payload", "value": "0ff7517982493d6efc999e1b18d56c8481929f7655689c001f29d0b4bd4f10d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229413, "uuid": "6e490d6a-a04b-4c5d-8aaf-7a29d37e877e", "comment": "Malware payload", "value": "5434fa5c16d8d2eedd1e8cdce0bd2d250b831651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229413, "uuid": "75baaf6f-bd54-4d3a-b502-a56389cc838f", "comment": "Malware payload", "value": "488cee283ecdfb925a98a1d64b9bb02e2ab145fc8099ff7d71a0c5880b368e19c747349cb164d0f719eca84688870bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229413, "uuid": "a2c2aa3c-136a-454a-9606-f913bf3f0e69", "value": "T180B6E747E89580F4C1EEE174C726A217BE613489073437D76FA18AF11B26FE86ABD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229413, "uuid": "b91be8bd-0b42-452d-b0f8-7ba6d18309a3", "value": "49152:1Z7uZnDbX5bCIMFr6trb/TNvO90d7HjmAFd4A64nsfJWtqTIQqoJw:HImr6PeIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229413, "uuid": "32b9bb49-5cc2-47aa-a532-943af85ef18a", "value": 11058176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229413, "uuid": "817e4f5b-ffb2-4cc1-a0df-efd8190efb18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229413, "uuid": "73d9a098-8cd1-48e6-ae02-30f0ea922b7b", "value": "SecuriteInfo.com.Win64.Evo-gen.73241416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a87123c-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272136, "uuid": "f0929835-61b7-4523-9c52-f1fab5a4ae95", "comment": "Malware payload (Mirai)", "value": "6084c318370cb8a2ba50294290fe1f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272136, "uuid": "0fbb7645-dbbf-42a7-a51c-bf4720fa8483", "comment": "Malware payload (Mirai)", "value": "1016e6b36e926fb6d3beb7679f66ffe3c366f17b1219f63b70ea2f8c9e9aac44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272136, "uuid": "ce8318c4-7dba-4a91-adb2-ad68fa92ff12", "comment": "Malware payload (Mirai)", "value": "66f7186e053f1a52b93d4ce1b1e21731bcc3fba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272136, "uuid": "15fff317-3522-4d68-bef0-7119f95fb766", "comment": "Malware payload (Mirai)", "value": "addbe54f16feff03342aebc96600d81dec9bfdac4d7c9ba235fa8bf783a08e0fe30fd5b922181533830b8d778ae3bc0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272136, "uuid": "32cce3b8-35c7-4e3c-88e7-d55b05f78503", "value": "T16724085DE4508B3AC7C1227BF799428D33335F68EBEA730589256B343BD66259E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272136, "uuid": "fbf5c7a3-913e-4278-b612-aaca17a4a879", "value": "6144:LiBl1JNmBHPp8XCZUzUkUwOvyibzmrcwdm7eb:sBNmBHP+TU3nPm67eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272136, "uuid": "04fbe5fc-0b98-4a04-8bce-d4a32b9d46dd", "value": 209764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272136, "uuid": "c2c1bbc6-8867-44a1-9d62-041624ac1a30", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272136, "uuid": "4cae43c3-d220-4669-90a0-a629f26106aa", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159ba4f6-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252773, "uuid": "ec62e2ed-4987-477b-afc2-aedf08e47327", "comment": "Malware payload (SalatStealer)", "value": "6c1fce048dd6807e55ba57958a602c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252773, "uuid": "1a7f309c-89a2-416f-bd5f-e1d6cee71cb3", "comment": "Malware payload (SalatStealer)", "value": "105707e77e4156ee47c2eb95cfe2bf7b7cf13713fa2d348c6eee607a08b56bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252773, "uuid": "6edb6ce8-9099-4278-94e7-9a705d50927d", "comment": "Malware payload (SalatStealer)", "value": "7743d6480d2571922f62812fb35488c1c7472de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252773, "uuid": "561e7954-0b65-485d-bb46-f3c9883d5394", "comment": "Malware payload (SalatStealer)", "value": "bf241395a2bc5dfdfd689258db661a9e40923a29c3ad6c53a1d9f2ca0fb258079fd9b8c4955e2aaa4a79282d963731aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252773, "uuid": "1771b7e8-e8f7-4795-9bf5-74f3621ded72", "value": "T15CE533A903D5DFF3DA3FEDF660C14EA32A6CD1E3055A7ED730B20111682ED845E86A94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252773, "uuid": "72bb5aea-549d-4a77-bcd4-bfa4b0d21f49", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252773, "uuid": "3424ff29-1a83-4b72-8602-d167fdd965c7", "value": "98304:MczrIfAa3He1urxvRnHLA6Wa3xpzjRMz8wCgmv:MczrId+stRnrJ3xpnRMAimv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252773, "uuid": "d4cb23a7-91e2-4f5e-8f7d-b7b5774f8d7b", "value": 3292672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252773, "uuid": "f0a6963e-3284-4e7f-a538-a445c4a8f77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252773, "uuid": "679873bd-ab15-4d9d-b2b3-0c67c6bcdc4c", "value": "6c1fce048dd6807e55ba57958a602c5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68361b08-e6e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254200, "uuid": "1a326c3a-fa0d-449c-9fd7-2ed795596205", "comment": "Malware payload (Mirai)", "value": "ee5fb36eeea6df4c07e92abb7b902ac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254200, "uuid": "b19a52a7-c21a-4c40-96f7-727e57c89f85", "comment": "Malware payload (Mirai)", "value": "113bc2274f429d9cd5cb64c14738556807e72c051f5409a5be4857ed5480fb84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254200, "uuid": "d10fbf59-945e-4d04-8c29-1edd1add49fa", "comment": "Malware payload (Mirai)", "value": "6233acc5a63b9eafc7d373d53b878ee58ace8603", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254200, "uuid": "02bd2eb2-64b6-4977-bd39-7b4867fdb9ec", "comment": "Malware payload (Mirai)", "value": "13588dcaddb48ae3c47ef8e6c7cea139953728d6c7c544be7f2a6a460466c37aa44499f8cdd1744305e5507c2d20b495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254200, "uuid": "ce43dd0d-24da-4fe3-b355-cf048c32394d", "value": "T10BE2E1882058C10CD5988339772EEEF76BFDD68C4F8DCF8A56DA942EB541365911ECA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254200, "uuid": "4c756791-bb49-4d45-ac16-b7a737beb55b", "value": "768:uJisvUS/jY7liEctfQ5OKae4iTfATLgArxKKkvpdY8c:yiEUSsocOfe4i7+LgAriI8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254200, "uuid": "e27c1340-85a1-40e0-ab0b-50133681c0dc", "value": 33484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254200, "uuid": "3c159682-ec52-4ff9-8b22-17985fd63fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254200, "uuid": "303b3a10-1cdd-4026-8cef-294a29dc7bd0", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93d2562-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767228218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228218, "uuid": "7c109c5b-adee-4f37-9258-b2c9eebefc80", "comment": "Malware payload", "value": "2eeab49d374e60b43fc667ddf24f5c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228218, "uuid": "71484a7f-eab8-470a-a676-c02bc2a55393", "comment": "Malware payload", "value": "115c07d9bcf087f680c5ef1837fd02d5180758dcb34ccbf436d29bddc96cee3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228218, "uuid": "87b9f059-d708-449f-b6c0-569e414e0cd4", "comment": "Malware payload", "value": "2cca2cfaf993c4c03554f5a9aae19a5a31b29dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228218, "uuid": "3c6f781f-9d1f-4ef9-ac19-54550af90645", "comment": "Malware payload", "value": "9791ee547c26c605a91d9101b60108320372fb804847d61c8370d68b6242e32d419b8e6fb06061340fc70090d20252b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228218, "uuid": "4bca60f9-8265-4cca-ab84-f8570562549a", "value": "T1DE53F1D3888651C5FE781530CA91A623AE38F5E37BB25B935456C4404E41BA8B70DBBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228218, "uuid": "c04216cb-dcdb-4336-a2bc-58e453378f78", "value": "768:1y/Beqek3Fs7rLMydo7PQRx8ZY80p0sgZA/jZcsbRsWtIk3/C3wbk4ILoHSoe:2Beqek3yXRoVM0pZG9cs9sW1kwbkrcy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228218, "uuid": "c47195ae-18a2-485a-83a1-f01656fe6480", "value": 66176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228218, "uuid": "a869d4fc-c167-4a78-91ad-509d92c55d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228218, "uuid": "ae16c8b5-bf73-46cb-80cb-7f03a60ca56e", "value": "2025\u5e7412\u6708\u4efd\u7b2c2\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead9305c-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227361, "uuid": "1de96a0a-2fa4-4729-b28a-5f907ee79a0b", "comment": "Malware payload (Mirai)", "value": "8b1f52a2c9999742f8cc3200e9314f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227361, "uuid": "ed3ceba4-8cf3-4132-9909-41cce3051eed", "comment": "Malware payload (Mirai)", "value": "1177599344dc64f39892c3d3d66101bd5c28ddbbd23fd062a8ebe2bdef928e35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227361, "uuid": "04abf1a0-a1a7-4e74-9025-3824fa85e373", "comment": "Malware payload (Mirai)", "value": "402466588e41dddc5e2eedff05a131183888363a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227361, "uuid": "f7cc9c50-8ef9-4526-9599-9c14ecc0f3c1", "comment": "Malware payload (Mirai)", "value": "0684c8e84a16c36dc9d7454bae85c469c5e8daa69714132c8723efa29688af347e6d1945398a5db6cf3996ec4ee26b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227361, "uuid": "11a6f680-8ffa-42a6-81e6-d6834d8fdf14", "value": "T1FAE31B46FC419B12D5D111BAFE0E128E37131BB8E2DE72029D246F757B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227361, "uuid": "c016e65d-1d64-4eb7-9156-8cbc9efc7937", "value": "3072:/ux7NEQMU5omkUXHNNzFtaAcIqnlCBY7fXG9ig:7QMSkUXtNzjaFIqnIIXG9ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227361, "uuid": "748ba5fd-1072-4daf-83dd-37429e6ec0d5", "value": 150364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227361, "uuid": "a7c0b46e-d18a-4b5d-8517-288dc490ab5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227361, "uuid": "eb2f3fde-b515-4269-af8c-d83d038fd142", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd933311-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767228252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228252, "uuid": "bb277482-0f8f-4fba-a9ea-8e2d66ce3af9", "comment": "Malware payload", "value": "8266cf846d43404f73b99bd8cdf8da80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228252, "uuid": "bf723b62-28a7-492f-be2c-915130b2dd4a", "comment": "Malware payload", "value": "12621efded0dd3189158cfd1c03a2984a40ac91bfddd5414946eb59a584091d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228252, "uuid": "76d79035-78d4-44e3-b4de-49f5c6092cd8", "comment": "Malware payload", "value": "fa64f676d6ba480c068f2bf19e5be818c1796f26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228252, "uuid": "41dbc287-52b1-404f-a480-464c68e35042", "comment": "Malware payload", "value": "991075f1b28abfd5ab8a435cef4ea85c037f5ed2ffaae89ddcf7cd48ec7d1c32549c3c506d859c58d5a94f7bc0262233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228252, "uuid": "9e0d045a-3906-46bb-8de1-8a57e2619a06", "value": "T142A4007D8F2E93E5C1BACAF0BA31C2D2F5103948917696C52BC047AC6627460EDF63D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228252, "uuid": "3b7e3cbe-341b-4feb-82ee-f80065022a9c", "value": "510eeffba4fa5e8ef9d6050a17892678", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228252, "uuid": "85ef0764-cce2-474f-bdcc-6e8c150fc4d8", "value": "3072:lkO/pdRLaCbaajbvv/krm0Yfp2lFzKcKXiqaImDXtFooqluPIyC3xnP6JtSxuOiZ:X7aSKLmOqhsLEci6sGweb6nDABJNQUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228252, "uuid": "fe67543b-b990-4a12-9bbd-b625c5e6ed60", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228252, "uuid": "f5d12b22-3604-4339-b9df-113f12ac618e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228252, "uuid": "26b45142-2829-43c1-81a2-a93258b624e9", "value": "\u5173\u4e8e2025\u5e74\u7b2c\u4e8c\u5b63\u5ea6\u7a3d\u67e5\u5185\u804c\u4eba\u5458\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e968f70e-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227359, "uuid": "052dd0c3-0927-41fa-8355-06de2781571f", "comment": "Malware payload (Mirai)", "value": "1cc93249fb0837bcd8c48b69ea813f87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227359, "uuid": "1bebe555-82a2-4de8-916f-115c1ae3fbd7", "comment": "Malware payload (Mirai)", "value": "13340a1f5b6b1f9570df20d499bde2ffb875710c1c53bf98c44334a567228172", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227359, "uuid": "b84145e8-3e29-4ce5-82a4-9e4829d3e224", "comment": "Malware payload (Mirai)", "value": "e146fa4ba9094f896885644fac0c227b1279346b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227359, "uuid": "886b89ac-041d-48c7-bbe7-5aaed0617815", "comment": "Malware payload (Mirai)", "value": "8236c1ac43d6d36862de837704f2994e10f81b828383af92bf29f736350ed7555ecfbf2f073b4f68766e2b79fc92b98a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227359, "uuid": "5e56fe9e-96ba-4b11-aee8-39d8bc3c623b", "value": "T1C6D31A45F8515F23C6D622BBFB4E428D3B2A17E8D2EE7203D9255F21378785B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227359, "uuid": "bc824ea2-c4b7-4bd3-a7f5-e50d9d0cbca9", "value": "3072:RSwEoioOSmm1VCxH/4ziY5u9cNwO9qoe:RSbScH/4zh5uSNJ9qoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227359, "uuid": "80b99268-1213-4716-b04a-100066bc39ee", "value": 138048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227359, "uuid": "9468fba2-b9aa-4bed-b026-61d6bc4e097e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227359, "uuid": "a6f6897f-5ed4-4f5a-80d7-298834d4cb59", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78113b4a-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225880, "uuid": "bf068550-2578-4a76-912f-5d026df425d7", "comment": "Malware payload (Mirai)", "value": "8f642878aee21d0838439f6ae4749122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225880, "uuid": "52e83d7f-6b55-41db-95d8-3e6247db6744", "comment": "Malware payload (Mirai)", "value": "13b9d9fdd233c9ae6f61ddb0c52d724982a277ccfffa12f2d729d8b4482756a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225880, "uuid": "be833e4c-b67b-455b-b9ef-a225638cd37d", "comment": "Malware payload (Mirai)", "value": "abc7e19c063075730539068f46748baa03b1636c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225880, "uuid": "6d420a6f-2143-4542-a6c7-c5ea6ec8df25", "comment": "Malware payload (Mirai)", "value": "6566d679f34d6bb2945ec40de76774e42a30e19a3f0210544ac8bc260d97054662f5c26def7d9eb95a1281d5d0786d42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225880, "uuid": "cce19957-b683-424d-8b2f-84fb7eb88f96", "value": "T1767302AB5607D7B5C1D7B1F7C477D60C3C88795A410D8BEB0C2CF6A796F780A09AA210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225880, "uuid": "db1234f9-5607-4f69-ba24-4e57ecda19ce", "value": "1536:PFP+xWuV6En5c/a5TnqebhM1KINuvUc62CDh+cs9SaQcbTakxF:9P+xWu0aMQn7WWs1/Dhxs9LQcbTaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225880, "uuid": "9d4df932-c86b-481f-ae20-8f4b65b214c0", "value": 76168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225880, "uuid": "b33e739d-4018-47f6-ad02-08a3b00c855b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225880, "uuid": "29e67ac9-e16a-42bd-86cb-77cc4febe26a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65e8698-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767231676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231676, "uuid": "3aa4ac84-5b34-454b-9bc5-08fc681d88cf", "comment": "Malware payload", "value": "0d51eae91a22764674c0ab32616bb832", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231676, "uuid": "f4e47657-4be4-4f47-b9c9-78699a253902", "comment": "Malware payload", "value": "152158d8ef13924250d67f9f79c8ef18b2486d0788fe7126ab9f80b3259a8429", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231676, "uuid": "1bf075ed-ce87-4787-a7db-b4e415507207", "comment": "Malware payload", "value": "7ea2f1d0b9396698e654eedaecd5db34ee59ac72", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231676, "uuid": "a59d29c7-8f6f-4d03-8e7d-d4d41873dd73", "comment": "Malware payload", "value": "08da23318f6dd20f4386d9eeb8f41e44eccad00afd9fd1916c19bd5d971bdd6df9c3c7f27ad69d9ae18f88d909e6220e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231676, "uuid": "d2bc1782-3dff-458f-b1d7-5cfd0f4a5c4c", "value": "T1B89622C1AFE88927F8B25B3954F5EAF31A31FD916E6DCB8F9A14104D09B27409D60336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231676, "uuid": "b0de7e80-cc20-4fb5-8669-994ad443e482", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231676, "uuid": "2766198b-0b04-4387-a233-a40857113dbf", "value": "24576:AIZ7bSw98DrZGZN2s29azRdIgHHZodUvPLEDH1AgAa3zIizJzwOA5byy8V:AK7bSw0ZGZN28FvnIUnOGQzwdDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231676, "uuid": "ae647748-59ca-4b37-9500-39cb2b29e1e4", "value": 9453608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231676, "uuid": "c9bcd6c4-069f-495c-8206-1dfa0fc3028f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231676, "uuid": "8aa7219f-17e8-4d60-9ebd-6420b8150916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238327f4-e6ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767255374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255374, "uuid": "a3901283-621a-4356-a6d2-e03c2237aacb", "comment": "Malware payload", "value": "ac9a07911cf0e447f102454c44710af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255374, "uuid": "5e3c93e2-8bdc-4237-9db8-6c9cca28c213", "comment": "Malware payload", "value": "1565682646b8a4dd630ff2fbc37dd696f55132e9e83a0847e4231c471c76754c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255374, "uuid": "f132629f-07d0-4702-b0be-13a5990a2ab2", "comment": "Malware payload", "value": "2d9a6a6ec83fb5a2d788c49109207bd7e3a21a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255374, "uuid": "dd807bf3-d74a-4f20-8796-9654092f8723", "comment": "Malware payload", "value": "5bf31a73c28fbc1289e482b91b08e68b8b304e7d35ffef69f134a3500029c88c505de2c3c63d7822c31c5ad669bbb47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255374, "uuid": "71869ddf-d8c1-42c9-83b3-338867e6dfad", "value": "T12205F8247F968E00E544153E82BE6A14D732A4F2130AA347770EF7A24D449EEDE7C7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255374, "uuid": "0773a8e5-2a0f-4e22-9288-bc811178fab5", "value": "12288:3nvdkyJQQchQOO+27guONS9T6tgnMfPnGOZ:FQQchNN27gHSF6/fO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767255374, "uuid": "f441326b-1f5e-426b-ac01-f3b47d7f7177", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767255374, "uuid": "361f3567-470b-4acf-849f-1754f4862fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255374, "uuid": "697c8caf-7464-48f1-ba72-d2f417b18371", "value": "winws.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcdfceb-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226806, "uuid": "1b87548f-1cea-4f63-8137-5b5cbcee31ef", "comment": "Malware payload (Mirai)", "value": "ff0a15156b4cf756a11b2cb5011532f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226806, "uuid": "a996505f-dc9c-4bfb-8727-867976a338a0", "comment": "Malware payload (Mirai)", "value": "159f5ab12d215594005a25baa40244da88b009fe0e5c394aeb51596bed8037e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226806, "uuid": "5240cde5-9cec-4bd8-ab4e-564e079003d7", "comment": "Malware payload (Mirai)", "value": "48f8f74c2f1db0b948b41ac6ba7be524e5ab6534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226806, "uuid": "9835dd31-8cd2-4aff-858b-7b9aba723529", "comment": "Malware payload (Mirai)", "value": "5a4b894792f7a3c954e64a65de58ff0044d0eebe591c237defc3766a01e345cf957cca6cfa1610cd0d79442af73774fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226806, "uuid": "d3b488e0-0e64-4cb9-94b0-ad972c0a7a12", "value": "T1D7530945BC81DA27C6D462BBFA1E42CC332653E8E1EE7207DD116F15778A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226806, "uuid": "f9d544de-d161-4b28-ac29-f38831116692", "value": "768:89B/+6GJcTlMhv7p9qS+F1WarnKIC6MxuT7ev9mNdQxVBiko696ocu+7R:6/7Gj9qnrprnSvu3KwQ88Mu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226806, "uuid": "6beeef60-e316-41eb-afc0-c13a16382ace", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226806, "uuid": "e8210ceb-51d4-4fc4-8c97-d213deb1e4f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226806, "uuid": "08f8986a-434e-4d63-bf25-f0ec80f3d827", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94d1f88-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292186, "uuid": "a1f34528-cf2c-4ba9-a862-7ec110a6fc27", "comment": "Malware payload (Mirai)", "value": "bd72fcafd2891daf05d2c20995667f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292186, "uuid": "9ea4db39-4d4e-4551-8709-d0c371a17e0c", "comment": "Malware payload (Mirai)", "value": "15b26f93781de5da95dedd2bea2cd0280b9154e9f43bf583559a53bfcf10edb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292186, "uuid": "74694f74-682e-4f4d-9efe-355074b30495", "comment": "Malware payload (Mirai)", "value": "610aa06c60ac1530f9a05a80661b212e507111a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292186, "uuid": "5b44bbcc-f047-4c1b-9881-a41d7625207b", "comment": "Malware payload (Mirai)", "value": "5366d43e5f873dc24e86f8170b72bbac98235aa3834a08052c5f19ea8dc0374342a0f1220e1860e78613355987b0dc65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292186, "uuid": "d932b4b2-b776-41d5-bc45-1c4575cececc", "value": "T138146B63DD22AFD6C512A1F4A2F25E780B52BC1948171EB9B5A6EEF54043ECCF0193B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292186, "uuid": "13ef0e45-971a-4158-841c-39d33542364d", "value": "3072:uof0CsSizqxu+cod3cPHwIl1HLmGJtf6laBaVaW0UVFZiKsW:uof0zzqc+pJILr/Jtf6YiH0YZKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292186, "uuid": "977a4bc1-996d-4a1a-84a0-09b55185c396", "value": 204640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292186, "uuid": "c7ec68f4-3615-45ec-afee-44ea164f7869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292186, "uuid": "da0a90fe-2d5a-4831-b393-af91a5c9c8fe", "value": ".4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c8ca6f-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225875, "uuid": "2823a510-1c0a-4d8e-8e26-d8d1f7a34fcb", "comment": "Malware payload (Mirai)", "value": "5f2a8ae50611a27088f874b05c036ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225875, "uuid": "7dfb3148-3f78-44e1-b9ab-a7890805e227", "comment": "Malware payload (Mirai)", "value": "16aea82d4296bb3875238a557e6bc71de91bec3e31c1ffb5d67093c1e6e0e892", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225875, "uuid": "72da73ee-b157-4524-9264-165c5dea78c7", "comment": "Malware payload (Mirai)", "value": "ef49e63f90d6c101ef6845e3e0941d4a03d84749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225875, "uuid": "f2ab3277-4d72-41d0-b13d-00205dcd529c", "comment": "Malware payload (Mirai)", "value": "70af88cd62acbc47d1a4d8a8363a9fb66bfc2ef69af767862e61d02f5e70dd48d86fc2d83c06d556fbffd39d164685f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225875, "uuid": "31e4e58a-6a62-4864-bc99-27c39467ffc1", "value": "T10EF2E119030465FEDD7694FA1BBD8B9A61384FD7B6A9CE8B0304D548DF48CE0B172B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225875, "uuid": "db520e52-e54d-4dee-ac53-cace67aa1ff6", "value": "768:BeakB15kkC/uz2D8eo99slXvzx+f8ZqU9kq6jTJgGlzDpUYsk:Beac5o/GYxu9wxBH9X6jJVqYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225875, "uuid": "9c30cb75-9e6a-4328-b099-fd0b26501c25", "value": 35020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225875, "uuid": "ad477027-2e43-44af-bab6-d63af90bb46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225875, "uuid": "e1bb3064-2e55-46a1-97af-817dbef6901b", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6e65b-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297802, "uuid": "79484c86-a717-4d16-bb40-b86021af03c5", "comment": "Malware payload", "value": "36e48bcddb20d6908f478956cc0f663b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297802, "uuid": "679d5fa2-6347-4b6a-a0c8-0b363cdd6003", "comment": "Malware payload", "value": "17b13e7c3ddaee1e386f72e0b39495ac008352477597db647fe0b1a95b551366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297802, "uuid": "7d5fb0a4-4c64-42af-aa37-2133d9ab39d8", "comment": "Malware payload", "value": "721b3651a1e7596e891789c9c87732a82216e8bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297802, "uuid": "bb33a013-1da8-45db-8cd9-3a51ceb03836", "comment": "Malware payload", "value": "6472db433dcbe974f8f14a4d882438e586210bbfc4229d3d97997002b6c85dbde68be6e423bd778b1b516da5f2aeabd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297802, "uuid": "fd02b83e-2062-4691-bb01-71e86447591d", "value": "T151F47C06EF891FDBC47FCD70492E834715ED8AD706C1973461FC898CBA9E62A4AE3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297802, "uuid": "4dbc0e74-19bd-43e1-87c9-5d1c60e157f2", "value": "12288:TrV7jinK+vgIbS6+Fb64rpbdHlHNp+uTyYQa2SDn7onpK3Gj33x79EgwCA6kvhrd:MDCUZJxB4GvV25NyTkZ/jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297802, "uuid": "2642131c-e930-410c-b3d1-0745f25a1eec", "value": 729940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297802, "uuid": "08263f60-58a8-450e-b8a9-e23f0408b55a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297802, "uuid": "9826519d-c9f9-4352-8722-d0127035ccf9", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3eee31a-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767229417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229417, "uuid": "96d91942-a28b-47f6-80f3-3f79f71cb7b6", "comment": "Malware payload", "value": "f2a6b62fd23fdd7e8a84fb56a851c298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229417, "uuid": "cca2ecc5-e91b-4684-bb65-2b849d315b4c", "comment": "Malware payload", "value": "181be2f7f4b6b4e58202e78704f6ea7c27e15296789b12fbda17fafd4f8b11c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229417, "uuid": "33bbe4af-1522-4c72-83d2-29ddacc2e313", "comment": "Malware payload", "value": "7f939ee6eb58750f66ed921445879fc2977a0ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229417, "uuid": "9aba5c10-80e0-4d01-9ecf-117f7e268685", "comment": "Malware payload", "value": "2070f5f6b890961a39fdb6e7d6914589695ffa358ccb43df3f1875b5645097799f942da7c5b9e474eff714cccaf53f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229417, "uuid": "b82410e0-8b86-4c89-b5b8-97b74db566b5", "value": "T12DB6174BA89540F8C5FED274C625A213BD603499073837D33FA186F11B66FE86A7D368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229417, "uuid": "e1a77991-7561-4eff-9663-3504cf420e02", "value": "49152:3MBd8PIjr6PrIeZFrb/TNvO90d7HjmAFd4A64nsfJ:dP0eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229417, "uuid": "949be11c-54f0-4925-ab96-cb93d1f4a5f4", "value": 11058176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229417, "uuid": "a6fa667e-4523-48b3-95ef-51affdb06e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229417, "uuid": "9481a5d8-c7f0-43bb-8ec4-97624fd63db7", "value": "SecuriteInfo.com.Win64.Evo-gen.64613226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd6a75-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272143, "uuid": "36e0d2e6-16e4-425a-882b-0051e50c9a8a", "comment": "Malware payload (Mirai)", "value": "44f28dbc5c6eb2a1044792ecb09cdb8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272143, "uuid": "bc7f5009-308a-409a-ac1a-2488138aeb87", "comment": "Malware payload (Mirai)", "value": "182139a33bc476c258302226a87de1961af37305a850b5878ce2d2db49bc21e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272143, "uuid": "85b6381d-661d-4ec3-9462-32f2c3e9a211", "comment": "Malware payload (Mirai)", "value": "a409e021a37a01720fb6ca77ee875a9ca19a2600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272143, "uuid": "b8fb7936-001c-42fa-9bea-340d5e9b5454", "comment": "Malware payload (Mirai)", "value": "3d5863b87c13fd6586736c841e330c794b9820b03ea913849b529184e78b293583d84cb0428b37297137084eeba15bcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272143, "uuid": "cf258553-f18a-4f2b-885b-4c682b442ed8", "value": "T1F4F33A16EE50C0AEC096C1B86BDBC1B2B731F8B40321376F33A96E362E65E545B19357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272143, "uuid": "4a8f6d79-f188-420b-bcff-bba41b062839", "value": "3072:QPxBrX+G+mvbxLnAXFHWhNkLvXFt3bPbeud1jvncISCLXIdrm:QPxBrXJZAVHWY773bPbrfczZdrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272143, "uuid": "ab7b3950-e98f-44ef-ab02-6d35aefe37ac", "value": 161304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272143, "uuid": "2d16b2f5-77e5-49e3-9ddd-1a73ef50c0af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272143, "uuid": "25501004-dc69-4de1-98a0-000308cf75a6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e02e8b3-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228494, "uuid": "795c67fa-0c86-4f5e-9afb-e8e4c4cc8f80", "comment": "Malware payload (Mirai)", "value": "66f6dce1a762929320ef7e9e65a72898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228494, "uuid": "f983a1a1-fe80-4c3e-ab10-d6086ea5af8f", "comment": "Malware payload (Mirai)", "value": "18998ac29b5a39c14bbd56fdd6fb292c0b5302f40b9a8e53b29feff0cfaa9a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228494, "uuid": "be7d7fa5-8ba4-4072-88b7-3c8f45d78b4b", "comment": "Malware payload (Mirai)", "value": "6d96b1ce14d2e513300ea7d02f522983ccbb6cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228494, "uuid": "5cf9378f-f1ad-44bf-b841-79dac9b51d1f", "comment": "Malware payload (Mirai)", "value": "53cdedd7f8dea29cc4423d0f420a900f0c6ec3527ef40f1e1d570becf67aff8dfa0f7915a2bf582f72da51a7d7053e6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228494, "uuid": "b306d5c8-062b-46b7-b200-32d8afc2eb1e", "value": "T13F63020290BFECC6D444623D57DF32D29C226148551CC1F63BCA50AFD9A3EE96A4EAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228494, "uuid": "0c7f8bca-c75d-44d2-acff-5d040de72510", "value": "1536:H3ouKAECCwthUiXM8PolLmWSvB5orK8jTrM4oJrb512qLPnouy8HyV:H3o1KthJMGsiNUJjTAHJvflbout6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228494, "uuid": "b7a583f7-2e64-405a-b78b-45dc4201873a", "value": 66716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228494, "uuid": "6d0f0983-3654-4b72-b44d-4f326649c4ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228494, "uuid": "5b484879-9db0-4c9f-a991-c98b23f40bd8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75113410-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295454, "uuid": "fdd271ba-0323-4b32-939d-42036ccc83b3", "comment": "Malware payload (Mirai)", "value": "fa5cab252204ecd81e65de39fb9bac75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295454, "uuid": "012c2e02-7458-496b-9953-7f69670660ea", "comment": "Malware payload (Mirai)", "value": "193303564d52ce51409c02ba46fb0c60ff9aa93c32830cf92bcee50d7b9712ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295454, "uuid": "51a7a828-423d-4316-9c88-2114017d5b06", "comment": "Malware payload (Mirai)", "value": "35f0f0c6a2e0d89fca5dfc343f84f0c057478140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295454, "uuid": "74d48692-e824-4e01-9638-7edd26e6d2ce", "comment": "Malware payload (Mirai)", "value": "4794cf36ef8a303fff4a69b59ee1746061488eb5dec9db1b25a4534339d840daad588851f931564902fac1b466b26ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295454, "uuid": "4511cf65-2222-4368-a959-53ddc3e5691b", "value": "T13D335AC9E683D5F5FC1602391433AB329E72F13700A9DF96C768A539DC519A4E60A3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295454, "uuid": "dbf99585-1266-447a-828e-9fff73f34ece", "value": "1536:D/QUnh3gMYFKO4UEFd36WlBEmp30DTyMa7+5urY:D/QUnh3glFKO4X1Llp30iMc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295454, "uuid": "99201661-c4f1-4fac-b941-741418ef5e19", "value": 53616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295454, "uuid": "113050c2-9b1b-4053-aa61-05435dbb1f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295454, "uuid": "5b6f4ea4-389e-479b-a64a-d8416c1e20e1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c029c768-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226431, "uuid": "abe4c28d-2e68-498b-9451-6d7e2494574c", "comment": "Malware payload (Mirai)", "value": "2514d02ee26ad9c04c52b4778a88aa26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226431, "uuid": "a49d0551-af80-40ad-a04d-c7c6cfda5341", "comment": "Malware payload (Mirai)", "value": "193fa4f19fd90751c8043ca64085c6d5e586ad09cc034ca32437054e81dd7c46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226431, "uuid": "900e3903-6c6a-4dab-9d48-ad2f8367b6ac", "comment": "Malware payload (Mirai)", "value": "477c5cdce35c3a9ea781bc7079b8b09c4a9d3189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226431, "uuid": "71ac42e6-72d2-4fd7-a098-404bbced7ab3", "comment": "Malware payload (Mirai)", "value": "8bc7218a7b44f624a15bff976e6233a576d16e8403f4803717806113d62674fa6ac0a7c3b62120a488ddf1039de4d4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226431, "uuid": "0bc2462b-ee6f-4dad-b282-bedbf99285ba", "value": "T13E530945BC81D617C9D462BBFA5E42CC332653A8E2EF7207CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226431, "uuid": "142eb4f2-3a04-4b38-b785-0f9f8db4579d", "value": "768:k5BzSXi2bMgSf+7AVF2MlLOZLYNz0th4RyRiukqUM2JlyN+ThTm0iuM7R:6NSy2UF2eLOLwwtKRWkH7JlJeuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226431, "uuid": "9bfd0b60-9e14-41af-bd65-6338e2363475", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226431, "uuid": "403bd5d2-f0e5-4941-b748-4655d2bb55dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226431, "uuid": "82a164e5-4095-46e7-8445-d037f282ea0b", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5943034e-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226258, "uuid": "91f384f0-1539-4951-9912-f00b4e72d357", "comment": "Malware payload (Mirai)", "value": "f41333029edf791f1ab3276ace6d6225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226258, "uuid": "4c87d64a-608f-4d35-ab91-565c941aebb7", "comment": "Malware payload (Mirai)", "value": "19a8868db3173c24fa2110433e49681ef73079004b9d8761553a23d22df5c869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226258, "uuid": "e55ed2d9-797b-4a59-903b-393119317f3b", "comment": "Malware payload (Mirai)", "value": "ed46bfbffb1f8384ff521365dacad94be2f30e15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226258, "uuid": "d429f39e-d758-4691-bc4d-8b9ca05cd79f", "comment": "Malware payload (Mirai)", "value": "90c30c762eb5a8ea59819dc007e899b6d8798aaa6a0bdda2629da6ae158ca67ee542936725d0416a160bf46e2e3f9479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226258, "uuid": "3cf36f5a-434d-4e55-a52e-43deda81cacc", "value": "T12BD3BFD7730B0851C46242F05BD7DB8E3B6372028F1BC9E72E1D663A1CB95DB5A0A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226258, "uuid": "f45c7e9b-2e80-4fad-94d5-8feefec37a19", "value": "3072:LenG9wS53yyHEBQFSMRQngka9dVKS6U0gKCn+q:B9wSQSgQFJWa9MNnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226258, "uuid": "435ad32a-98db-4670-b411-65271cb8c2a3", "value": 140684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226258, "uuid": "25c1b0a2-1dc7-42df-8c39-21239b269ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226258, "uuid": "553bd77f-f6eb-4bf5-b721-e00fe3081a08", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5658ef-e719-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767275526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275526, "uuid": "957e6432-bae1-4fc9-84fc-d6126fed461d", "comment": "Malware payload", "value": "ac3c3c90e8fcb2518d02b607ab49306a", "object_relation": "md5", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275526, "uuid": "aafffe32-955b-4a31-8c66-92f029d7a9ec", "comment": "Malware payload", "value": "19d27e68984140597887aded6c8f28ab3244ef868dee9f9a875693ed9d1c2d64", "object_relation": "sha256", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275526, "uuid": "b4274ecb-e861-4e84-9e90-a82d836a0968", "comment": "Malware payload", "value": "cd79ccceb384dff3101385dbfb24f07ee0ed7adc", "object_relation": "sha1", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275526, "uuid": "e57be3d5-4e6e-4c6c-b311-6fe61fb51f06", "comment": "Malware payload", "value": "a40de80406054fe125315c3960630e4f0c64720e919555e39cd3a6a3c485a85e8cb423bbe9f437549888a9cb5e7f7b41", "object_relation": "sha3-384", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275526, "uuid": "8a8094d3-7c5a-467e-b9e8-fd2827703612", "value": "T1BD95E086F796A86BECF3C736873A455E5A128C568B83E3874954B13C0CF79C08E55EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275526, "uuid": "30b58d89-c181-45c1-a711-a8e42d2e9f64", "value": "49152:3dtQUC0p8Iqur1ZlQYArVBtBH/wZNuzTplP:Nq08taPlxA3tdwZNgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767275526, "uuid": "1334aa9f-1f87-472d-a54d-d94856f55ebc", "value": 2060365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767275526, "uuid": "e1b8bff6-991f-4250-9639-496355567dd8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275526, "uuid": "b2d42938-aa53-4a20-b030-89766e72af0c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f8e50f-e712-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272821, "uuid": "4ba7257f-02ad-45eb-b644-e55a71f497b5", "comment": "Malware payload (Mirai)", "value": "ed9b7086cbc30f8bc7af70e4f56d9a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272821, "uuid": "7c17dcc5-00e3-415c-97b1-3d74bd177804", "comment": "Malware payload (Mirai)", "value": "1a4f5ccf14cf840bf480e06f0c93fc00c6b67eeb0e8ca03ce686ddb01be64701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272821, "uuid": "cfc72eec-d37f-48ab-8ea1-d2bcbc9924a2", "comment": "Malware payload (Mirai)", "value": "1f482e981bb6aa35a63dbc7248e51805323ca69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272821, "uuid": "42d45d8c-13d4-47c0-8f30-a239debc54a4", "comment": "Malware payload (Mirai)", "value": "cbba127a77aeb4aa859a394d32c3ba75c3661c45fed2630c63517ac5bd7c2fcbf195c6b2bb02c6a2b9ee21138cc8d10f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272821, "uuid": "2843a58c-f05b-4f8d-84b2-fa77617373b2", "value": "T119044A56BD91DE12C6C125B7FB6E828C332713B8C3EB3102CD255F61678A86A0F7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272821, "uuid": "a037b446-f8c8-41a6-9261-f72b18e04280", "value": "3072:EmivMsT1LEYHZw5j/IroydVcpVCjXX2eVtj09elaB9Gny:EmixT1r5w5j/nyaVCjn2eVl09ekBQny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272821, "uuid": "b555f0c1-e3e9-4399-9d15-d775133690b5", "value": 182148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272821, "uuid": "a053f811-154c-47a7-8900-22ef02a2d776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272821, "uuid": "e5fb384a-d0e8-40b9-8c81-a10231be65e0", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a95f2f-e70b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767269574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269574, "uuid": "feba2f7a-5d22-4ce7-8c2f-870f50e37e77", "comment": "Malware payload", "value": "e917ef7da75ca6dddc4e3f2c14c46cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269574, "uuid": "eadef63b-b373-4fbd-9618-66063ea4a4c0", "comment": "Malware payload", "value": "1a7eb992151484f583fc4a4dd64f3848cce1bf7c0bc9500f23e8ebcd46c17bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269574, "uuid": "cb62213a-ced5-4599-81b5-a0b55aa5fa1e", "comment": "Malware payload", "value": "4c870dfb18608fbcaf87c8a3477d6112f8210271", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269574, "uuid": "43fdf45a-b517-4173-a73c-3a1025a26cc6", "comment": "Malware payload", "value": "207153eed7641d715d19ab435761bd2bf46ff94c41884f865a9276b8a4fedd90d200b447ddea6065c1f9a5afb6db7cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269574, "uuid": "84253095-987c-4475-8dae-c49515ae2b79", "value": "T1C244231036743976C3B498FD08CCFACC9ED98A19881D6EE3DA3490F51A8518B1ECBD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269574, "uuid": "08c8284c-cf0b-49a4-9dfd-2ff8320c0c2d", "value": "6144:4Fq3qYcWvV7ljfTkYvzuzhokcfFJidztRASUFYvdDPA0xeokj7G1v:Cq3fzffTItBUXwVdDPOjS1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767269574, "uuid": "2d5e45df-42d3-427d-b380-bd7053cbd053", "value": 278268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767269574, "uuid": "01ad5698-a918-48a6-abb6-3d0da19bb48b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269574, "uuid": "920ff4d7-ce35-4cc0-8848-3df0f3760a9c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96fdfea-e6e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767252699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252699, "uuid": "4fb2eec3-1f03-42ba-a1ac-70816aef8c02", "comment": "Malware payload", "value": "2c0b101cb418bd93c955d9b4f292afd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252699, "uuid": "035d6e76-89df-4f63-ba5a-fe8aa7822033", "comment": "Malware payload", "value": "1b6ac47a1eab5f030214dcae439d4ca9da9330881616791553e51855fd7dab22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252699, "uuid": "cb71d133-716e-430a-8225-01ac3a9ecbca", "comment": "Malware payload", "value": "1390e81199f2c3baa7983d599337127e6f9a0cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252699, "uuid": "0fa77283-1a28-4c6a-9d1d-6d3aba0791f5", "comment": "Malware payload", "value": "864e45035a560225cc320cc9e6cf84e85e83da04879cf0c609d6c63170c3eaf68e8bb4c137ef0b92aee1a1dbe623f424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252699, "uuid": "a65ecd58-f90c-471e-8ac7-89694be8cbf2", "value": "T123D31918E610C439FCA610FAC6B50BBEF9786B20131511C3DBD1BCFA9A1AAE1753456F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252699, "uuid": "cecfaa08-9809-49e3-9d74-1489c52a4824", "value": "386b1554197eb63ab49070d68f4b82d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252699, "uuid": "d6c98a7c-bde5-44fa-af0c-3f2ed668b689", "value": "3072:kc6P0mawceCRgdZ2TDlsdImrYvymwlx4:kGlXy9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252699, "uuid": "d4b451b8-e38a-436a-be41-bd5bb98cf87f", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252699, "uuid": "f6dc0d6f-bb0b-40e2-9451-c9cacaf5598e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252699, "uuid": "9330ac55-c064-49f1-9e8f-248cddb2d6c0", "value": "2c0b101cb418bd93c955d9b4f292afd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81204312-e6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251236, "uuid": "ab9f592a-e043-429f-acd0-a4db89418f7c", "comment": "Malware payload (Mirai)", "value": "576a35de015b423da2eb76b3b62428c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251236, "uuid": "3d828f66-c636-4ab0-ac55-847fd5fd96cd", "comment": "Malware payload (Mirai)", "value": "1c7566150d492a56b6c60744e19b1d461dc478018042f1302d0e5620a40e4bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251236, "uuid": "c0031e6e-34cd-42cb-9087-4905a8226ec5", "comment": "Malware payload (Mirai)", "value": "b00bef0ae058d87a453e46d53d20c2b7e87f7e08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251236, "uuid": "64d08c3c-9ea5-4927-b03e-11eaa2404796", "comment": "Malware payload (Mirai)", "value": "68f128d338486e28252edc972b5cf35086f84308576eb7671280db3a9f357eb588d4125b40b962fdfbf24bb5bf2640aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251236, "uuid": "68f49970-ff0c-418a-b832-d4667f84a99c", "value": "T1EF93D715BB650FFBDC6FCE374AB9070525CC651A22B93B363534D928B60B64B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251236, "uuid": "9054a79a-59b1-4ec5-8e95-c8e4826a7188", "value": "1536:qNyBiGbtuLWm2VfyMU9iSGRQiP1L4JxegctZv2+JyBf1Z3pfL49X:qUBiGJNjIulCxe5tkBTy9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251236, "uuid": "ecbf95ca-c50a-40a1-aa5b-3a0988bd38b2", "value": 97368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251236, "uuid": "d39a1d2f-b31e-4f65-873f-3e15f3c3f166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251236, "uuid": "d012c9fc-4efa-42de-b26a-b07cd404dc11", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aad901-e707-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767267943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267943, "uuid": "da8b2bbd-76ea-4905-874d-e8d9ab9d8217", "comment": "Malware payload (Mirai)", "value": "b00d89a8aa52733e98777e7e78c30e5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267943, "uuid": "b652d08b-16b5-4138-9137-27dbe8321b28", "comment": "Malware payload (Mirai)", "value": "1ca3d025cfbdcbd71b8680120b826c949e54aeb56ad8ff5b61ccdf7026bea06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267943, "uuid": "a619442c-1f9b-41b7-aeec-bec938742856", "comment": "Malware payload (Mirai)", "value": "f3146876e89f3355aa928ad20ae9d2d8105f18dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267943, "uuid": "922fa52b-60c9-4293-9794-30bf1092299e", "comment": "Malware payload (Mirai)", "value": "963e755635e1efd047a9e8741af6a79114b4924e5f8edefb3dd8754b8f68538512edc679192f5963eca343c50349971d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267943, "uuid": "bd418da5-41fd-4f1f-9ace-04fcb4662a73", "value": "T121056D1BB2E3B4FCD157C430439BCAA2A935B43542216E7B65C4D6313E2BE701B1EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267943, "uuid": "915223e0-7af0-4c38-abf4-9e9db512d211", "value": "24576:Xuv+dgW4sMk89vzhQwHhjV+S9ltW0UHuiQ:XuvjW4sMkObfZ9ftWyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767267943, "uuid": "be9a8f05-3660-49a8-96a6-c5b4a4643fe5", "value": 835920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767267943, "uuid": "fd13cf4f-1727-4b17-8486-5be5612f5c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267943, "uuid": "aba450e8-cea9-4561-80cd-8632127863a3", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f94c7f-e71c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767277141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277141, "uuid": "a4cdf301-8a27-4e04-ab8a-c4a66c93f3e3", "comment": "Malware payload", "value": "9afe64d4aaebb9b545424d6f8d4fa625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277141, "uuid": "42876439-aae0-4bec-8912-c400f62fe32f", "comment": "Malware payload", "value": "1d77a80bd06de1f3acd15b880c0ddf2b91850dda9aa7307fe87c9852ac94dbd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277141, "uuid": "b5d09112-54fe-47a2-8540-694c4373868b", "comment": "Malware payload", "value": "3e94bee6b6dfa9adb4e660537a8d731824a95956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277141, "uuid": "0c4f1af4-e5db-433a-af45-c7594b2ef6c2", "comment": "Malware payload", "value": "65ae35afac7756e97f8d3ada0a10815a910f07c71e478c39b64339ffc5054df09c848ce73e06f381e0b79a2d4cba2ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277141, "uuid": "917ea8c8-0b88-4d16-a73d-97a8ffec906d", "value": "T18A84236AE901FDF2E1F97AF23B4786188291187C5D34B659B81D7BE2030CEB14F16D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277141, "uuid": "8e9b105b-37ca-4d2a-a971-1296c2671e08", "value": "6144:5JxkJfMYPUJ9FIbp6c4/s1wYKRQpo9h0nKpsR8UPVOSZYPcVa7UVaPr4XbU2mFLk:Txk7p6cy0w9RAohiTORUVa7uMyYDFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277141, "uuid": "b30328f1-90a3-4768-80dd-acebaafe19d2", "value": 391051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277141, "uuid": "bc41f8c8-162b-48b9-8683-76441fc9ca03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277141, "uuid": "706d841e-8532-4744-9fb8-d06afd443a76", "value": "bizy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be73958-e735-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767287573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287573, "uuid": "eb666d99-700c-46e5-ae4f-f60e4ee7d46e", "comment": "Malware payload (ValleyRAT)", "value": "1272e1625ae43ced8f9379c7266a37e7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287573, "uuid": "a687f854-f735-4dc2-986d-5210153236ce", "comment": "Malware payload (ValleyRAT)", "value": "1dbec1c38bdc8c5087f0df7d4c0794a78f6079a741420c127d529907767f2ab9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287573, "uuid": "e272bed7-4dfd-4a43-86c9-ecc41623d6c1", "comment": "Malware payload (ValleyRAT)", "value": "c0bf356d237d614c4a59336295d9ee8f1355527d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287573, "uuid": "f5b8a493-f42e-43bd-8983-14bbace66391", "comment": "Malware payload (ValleyRAT)", "value": "a3d9a3c34b3a0e2e9a82884e68c0aa8d70b119e7b63a3b17e06726f9fbf06f6097aa33cffd376e75ac232597e8651887", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287573, "uuid": "632e5dbe-0074-44b6-a3ef-418d5f4913cf", "value": "T13BD5CF21778BC536D16D01B3E92EEE1A603DAD770B3001D7B7E8795E29704C1A27EB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287573, "uuid": "e8c757f5-5e50-4184-84f9-9f588c56ddb5", "value": "49152:coRP+TEanLBm/usqOVX7GpJADREFClUDxuj45G17Vu4Df2Xu+6DWe9+PUuQO:oyXilFC2Yk0d+6Dz91ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287573, "uuid": "b4a390cb-fba1-4aaf-a8e8-be771c34bd7d", "value": 2926080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287573, "uuid": "ad03f4bd-cbe1-4adc-bc52-7d93005d2006", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287573, "uuid": "1f2467c8-335e-418b-bc9b-05f7b3d8e25a", "value": "image_2025-12-31_13-14-13.png.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532faa6a-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270486, "uuid": "5bba8d44-d7df-4139-a63f-443cad1e6e12", "comment": "Malware payload (Mirai)", "value": "fedaaef8af71107f1101e092acc7f892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270486, "uuid": "b4ebbdc3-d108-4eef-821f-4293ad0f69ff", "comment": "Malware payload (Mirai)", "value": "1e23c14ce9ff9ee3ae9d763784e8fc8f8ee49ad12023a52e80bfd46f0ddeb672", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270486, "uuid": "3946f126-270a-4cb6-994d-377d88b41a06", "comment": "Malware payload (Mirai)", "value": "6507e91c534871b5d968920b73a835441b5d290d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270486, "uuid": "1f96ff35-5bc3-414b-a7b3-7011803b04d4", "comment": "Malware payload (Mirai)", "value": "8b95c37e5102a4f5e0a23ceba877596dd29644ee4d880c1554250ee42ce13320e3cbf2895e90aff39130f3eb2b379008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270486, "uuid": "8c24618f-22d2-42b1-af86-e9c38c0f26e7", "value": "T162630852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270486, "uuid": "d6b52de4-3bf8-4ccb-9aa4-ec7aefdcd842", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270486, "uuid": "ffe21c65-1c82-4a0a-842a-c5aa380a9b44", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270486, "uuid": "cb39fd5f-6fd2-4be7-aab6-9f5f3f89b323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270486, "uuid": "4b631a97-80d7-46d4-ad7e-7f696755ee01", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498ca659-e731-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767285932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285932, "uuid": "fd25b49c-d5d6-4ecf-b10e-1ef2a30eb225", "comment": "Malware payload", "value": "f1eb9ae5a82f2aa5c4644969405a5394", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285932, "uuid": "3ff6287f-2e8d-44fc-ab4c-1cf148c09f18", "comment": "Malware payload", "value": "1e3af6f8a9428ec66d6983c94869b4702a7d501738997dbd2cf9cf14463dded6", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285932, "uuid": "a52ec493-43d4-4d0f-b936-eb87df09fb25", "comment": "Malware payload", "value": "2bcfd4c07cd35295afb9962a69410f9d605942ef", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285932, "uuid": "fbf8dc5a-ffb1-49ad-b30e-68112b6de75e", "comment": "Malware payload", "value": "1e02a3e0f47dd0ca56c713f8a176b5c9aa446edff0a44b85b37031f85e7016b38bbd8661092a6f76bfc96c8a3a1d9495", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285932, "uuid": "4b73448e-713f-4ba3-a067-de3b26653a89", "value": "T1EFD7125CA2DE587A06BCA93A6170C2FEE69AC1D1A7CD21153A8F74C3DB2514381D33E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285932, "uuid": "7e3e08e4-6ded-470e-a785-ebe770a7e62c", "value": "49152:E3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3T3To:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767285932, "uuid": "88658357-4ada-4bfe-b13d-71a0a8ae5418", "value": 58551768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767285932, "uuid": "49610df1-4d99-4007-8f11-c7813e98884c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285932, "uuid": "bd3ce454-085f-4a38-9ea1-657c57fb6601", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68a69ab-e75b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304207, "uuid": "0c3e6bff-0636-4416-9b9d-31a32527f63f", "comment": "Malware payload", "value": "8542b0f8dda8cd98d94178d60ff57c8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304207, "uuid": "f9e1ad2e-c6ab-46e5-88a4-51eb953a4b98", "comment": "Malware payload", "value": "1e8dcf82caf62fb4950abbf62744d0ee8ad6782c7d3863f81c3d94f279e9c7e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304207, "uuid": "4f1c3cb8-5c7b-4209-ad64-a2a1c0a2cd14", "comment": "Malware payload", "value": "282c436b3c5c4e0f8efa137c4b3665f00d104726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304207, "uuid": "306b50ea-1f10-49cb-ae69-c26dc7af0a34", "comment": "Malware payload", "value": "9a9f886b0929368f79c812e54ae9c0f64aab0c505e0dfaf20835d06a7a683b6b0d82a8ff4941185fa726a469a20a4a02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304207, "uuid": "1e2270aa-2cc5-486f-a9b0-8d55b59c79c8", "value": "T1AA464B03ECA559E5C0ADE2318A629153BA71BC485F3127D72F90F7282F77BD06AB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304207, "uuid": "935c6d6b-2b1e-4daf-b71a-ce020e87adfd", "value": "49152:fYei5ACJPYjr9G//7JSm91Z7NFxHEGGpmVTvu4X7RiZHkWcIY8l1/SVcqHKQKDKZ:fYyaAIrjNHgpAvuS74T/YtkbfEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304207, "uuid": "745f0bb4-371a-4491-91fd-6dfda66e4902", "value": 5816504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304207, "uuid": "f6c9ed86-33d0-43c3-bb61-23aa23ecbbea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304207, "uuid": "b5ba8029-334f-4d26-a1f2-dae637d2db24", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc7a42a-e73d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767291146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291146, "uuid": "9111116a-d86a-4166-a63d-19c530db104b", "comment": "Malware payload (AsyncRAT)", "value": "1f339939ec171efd4dcf8f89b460206d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291146, "uuid": "58daa1ea-4bc5-448e-88f3-ce79901f48ae", "comment": "Malware payload (AsyncRAT)", "value": "1f37cd2171df037e8f8c18de4a69e7af8900884cdfccd4fb41888dd9d5e185b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291146, "uuid": "177bb997-ab2a-4e7e-9552-354ea4754779", "comment": "Malware payload (AsyncRAT)", "value": "a3bc9da24f2c632a58391030630f963a32fac9a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291146, "uuid": "78d05e57-4ed2-4fee-97ae-368f0dcab0cf", "comment": "Malware payload (AsyncRAT)", "value": "a93e532013913c591973831b0f4e4d7578e5bac0935bbdf6d88309f3b72699e8e184cdaf6d7f0925b52cbfc58241398f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291146, "uuid": "88af220f-6e03-48c9-97fc-46aee3909f61", "value": "T12A232B003BE9822BF2FF4F78A8F26145467AF6672603D64D1CC4419B1623FC696526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291146, "uuid": "6eb3d05f-6185-43b5-9a21-2fee28e52e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291146, "uuid": "b4aa68bd-e035-480f-831c-774a669d71d7", "value": "768:guFgVTgsCN3WULUSVmo2qYy2bqDtX7tPIGzjb/gX3pq353aUq0TLiD6BDZveAd:guFgVTglf2OGwtLKG3bIX5kaUTiDkdGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291146, "uuid": "6d377ca3-f414-4cee-868b-b99e9618e710", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291146, "uuid": "d8f9c3e5-82fa-45d3-a7a3-cc0226d7fad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291146, "uuid": "940e19eb-a806-4b67-b134-bdbf81c5cc08", "value": "AegisEndpointAegis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2b8264-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767280433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280433, "uuid": "4c009897-9095-4cad-b44e-c9d5ff48f7ce", "comment": "Malware payload (GCleaner)", "value": "1d94c0df6be197d69c73f17efa7ee616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280433, "uuid": "3be181ab-8e24-4813-b4ce-be780ba88167", "comment": "Malware payload (GCleaner)", "value": "1fa959747bdebeadc431a76c19ed769de01f3f4e710e57875ae4edec57e47a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280433, "uuid": "7c58713d-2212-46f6-866b-e45b1cc58a48", "comment": "Malware payload (GCleaner)", "value": "1f107f2edae8d9e955975f2cfed999c9e1915d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280433, "uuid": "18e7b9a6-5f5a-4fd0-8bea-f368817c7bc2", "comment": "Malware payload (GCleaner)", "value": "7b3f0acd5351015f51a18534cd95be8b1d31653eda65ca3b1dfd30e36eea2514446349fb324c97ce2a0369689205af8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280433, "uuid": "84dd547a-3f11-4e6b-bd82-b7e899e2c8c9", "value": "T14446D001FEEE6415CC2788F45B1AC0780B26F611EBE708D6E9DF19646E641806E7FA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280433, "uuid": "86863bb2-0325-4ab2-b9f4-2b4dfedcd054", "value": "fbc991e59433fb0ec9ef6a99a5160fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280433, "uuid": "cd872f75-32b2-40c9-9d0f-4220709eef32", "value": "49152:eyUggGmuNopdJ7/xwAuN4+bVxyLNXar8/2gluxyv/CtToGLNytdkF:eyUrdh/2TN47EIOzyvKtWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280433, "uuid": "8f559879-82af-457e-9cbb-e4bbe6066804", "value": 5395728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280433, "uuid": "7fbbc923-579f-4d1a-8465-6579d8fc71f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280433, "uuid": "4a3fd09b-a9ac-454d-aec3-f4701f209974", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895880e7-e6d7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767247384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247384, "uuid": "83885b43-08b9-4d28-b484-5fc6bc632e2a", "comment": "Malware payload", "value": "b668b11a2a2c1aa693d3ab16f4863b00", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247384, "uuid": "c829aa16-47b5-43fa-8e9e-075146a9303b", "comment": "Malware payload", "value": "1fc3c9e695fcd4af0944aa3a9ab4f09512b32438292e7ee01f745483d5d1faaa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247384, "uuid": "5bf5ff64-93dc-4208-a0f1-e7baeceedd32", "comment": "Malware payload", "value": "e2c76af77387ba01359925483e85bc81c0db8b44", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247384, "uuid": "805e7c9a-b6bc-40b6-bcec-4f06a8bdcf20", "comment": "Malware payload", "value": "e7ba08d9a1f4812abf3f229553a3345003d9f2cad78e435d70c9d36b91728f9e5b123f5775350c31e19de29f0f49b5ab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247384, "uuid": "3bb751be-8e74-4942-8dc6-0b1b749d0661", "value": "T11BB47D99E76503F8D0A7C6B8CE434503FB72BC464771A69F03E04DA65F236A19A3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247384, "uuid": "425ce56d-57e5-4f9b-be11-fc65574a6f2c", "value": "e64c502ee43001a7009290b3adb5a27a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247384, "uuid": "2e0f92de-c436-4051-beab-68101bda800e", "value": "12288:Bh1VrPNHEfJKOIurZmIuFILSDG8pqKssGf6d:3LNHE8zdIuyer4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767247384, "uuid": "dcab00d2-e21e-4bf6-b6bc-6c7f4ba5d45d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767247384, "uuid": "13b2851e-2795-4728-90c9-9069b7f7b8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247384, "uuid": "6c5aff00-c96e-40a6-a86a-d85ec17e4e07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83514198-e6f7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767261118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261118, "uuid": "84072806-bb6d-4100-9cdb-0085d3317141", "comment": "Malware payload", "value": "d19b25e66cbd9ad49e923aa34ecce423", "object_relation": "md5", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261118, "uuid": "341448c4-0ef1-43a0-8480-a6361a3939a1", "comment": "Malware payload", "value": "201562822ac0fde495ba8bbb435da04b015a3b9965fa802ea6cb194d32573a92", "object_relation": "sha256", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261118, "uuid": "5005e238-469d-4ea8-881b-4c088a9bf023", "comment": "Malware payload", "value": "f801cde6f15c92678dc4989b6b7041f76d15ebf5", "object_relation": "sha1", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261118, "uuid": "41a4efd0-86be-4451-a1e3-b53725277f5f", "comment": "Malware payload", "value": "053fba002bbf11b61533cceb31b517b8ca803fb850122d346c70e7eb8b0729e906c59a7fb15a61d9ba86cfef0f272928", "object_relation": "sha3-384", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261118, "uuid": "dec5ff91-d23d-42fe-afb6-e15547f74867", "value": "T149B35A6773F930F9E5B68278C4550645DB72B87247619FEF03A0469A2F232E18E39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261118, "uuid": "8cee874b-93b8-493a-9601-de00e8bb2d03", "value": "cc1dea25fa8a176fc4f29660d5127e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261118, "uuid": "5ae7a08b-ba7d-4e38-b2de-7440244a63e6", "value": "3072:Ohv+jJK1E5us5ErFD5A10aWNRajq9XNKbV:7j5ZED5AexaGXNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261118, "uuid": "faaba991-d915-419a-869e-7671329f1b50", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261118, "uuid": "b20cf92f-656c-49a2-b7cc-aeea39851b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261118, "uuid": "04b44a01-a916-417f-8e69-8c06b61d6ac8", "value": "thn1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74640b1b-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (SSHdKit)", "timestamp": 1767295452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295452, "uuid": "638cedde-74e8-4a71-8644-edb983a4fc78", "comment": "Malware payload (SSHdKit)", "value": "29e0b53346e0a2ba4112162a7ee5076b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295452, "uuid": "f1ebbac4-898e-4ec1-ac11-0d4527648675", "comment": "Malware payload (SSHdKit)", "value": "2098494a9bca98f21a963cc947d4390490aea3cd1d12fc4b61f8ea8f283ce2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295452, "uuid": "0398acc5-5e5f-4a9a-bfb4-44074a6dab80", "comment": "Malware payload (SSHdKit)", "value": "6d11a8fd7f22b9feafa2f77d5345c02425bb4597", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295452, "uuid": "76a1a378-139e-40f6-b716-d6f23563625c", "comment": "Malware payload (SSHdKit)", "value": "45092dc4c72bb153ec162384b5db68a8e4b5c0a215a99735076f0f1d0c38a9a6688bae64848bf1d91ade905b74436cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295452, "uuid": "c255df96-f9e2-467d-89e7-a170bbc67b5f", "value": "T1E4356D56F9808EA2C5D8177BF75D835833234B78D7DEB102CD08672477AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295452, "uuid": "c575a7e7-a780-4734-a360-bb7e14d01117", "value": "12288:E8dASOYRNCAJump208iJftl7zNnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO+8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295452, "uuid": "2cb50125-9475-4cc4-852f-582da1d66c7e", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295452, "uuid": "a97b4adf-9983-4cd1-955e-ff29d7e11672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295452, "uuid": "08e6d2f9-cb25-4c4e-b256-7aad2b27eed1", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e811d1fb-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227357, "uuid": "f42e6675-9b9e-4f63-99ac-ced6dcc9235b", "comment": "Malware payload (Mirai)", "value": "4480b81b1d4247153da54acb0dde8e09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227357, "uuid": "270cddbc-982d-4500-a97f-af4d4d7cb654", "comment": "Malware payload (Mirai)", "value": "2112c888a2ca3982b40f60a9af69c44bf07bf64d5502a02d2058734ccde2f405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227357, "uuid": "9e13c4bc-94ce-4c70-826b-638a66c073ad", "comment": "Malware payload (Mirai)", "value": "c693f0c7e0453110d7e1c25eb70b8317cf2dbd17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227357, "uuid": "4afac1cc-150b-4d23-9399-fc8488027eaf", "comment": "Malware payload (Mirai)", "value": "a928b79d9e5bb83bae53c69aa8959b8e5f3f3f03ca56d7ec1c278304524bab08428a8c91f5c2964cc9acf12ef9c87240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227357, "uuid": "ae5e1b2e-ffe1-48f2-af69-ae86814a2aa9", "value": "T11AD33C06B31C0A87D2A32EB4373F67E193EF9AC121E4F640295EA68E9172D335585DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227357, "uuid": "305bf5ce-285b-4364-b519-e7df66f7d5a2", "value": "1536:tuJOoYEBkHFNBsVwplmH4aN94MowhdZHqxvgvy91/FmofvZyGytTJvASgVOkkv4y:S/B0Ne0U7Bh/Hqx99TrZy3tKSEeiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227357, "uuid": "3676edaa-4c3d-4bb7-8ac1-c354f76cd633", "value": 138644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227357, "uuid": "77d380c4-44aa-400a-a447-a2d7f938d12d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227357, "uuid": "15c6bbc3-cdaf-4bbf-a70a-d1ce55adee44", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efefd705-e743-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767293942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293942, "uuid": "77b72a42-c39a-4cd9-9291-986da071353a", "comment": "Malware payload", "value": "56a33e485e089d8d7709241cc63b5792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293942, "uuid": "b3a8c505-af9a-4cde-ba3f-b8036ef080e0", "comment": "Malware payload", "value": "212178ea87075f0e7cdd71a67ab6918cd43af7a171ee7b4c554c6f2d7390bf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293942, "uuid": "6b216b71-a2cd-4fea-a23b-0db2c66eda6c", "comment": "Malware payload", "value": "682955f48641b372b85e41983e2f637358d35bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293942, "uuid": "ed6c6d37-e44b-47e8-b4d9-687e8a506168", "comment": "Malware payload", "value": "8f7bea26a731199b1b5a21df9279316ce8b75a0110d287bdf016242a64af0f7dc2cf8cdffeb31e55795c19e60cfb37bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293942, "uuid": "8ae7c5f4-ef2b-4bf2-ac59-eb885abae6a3", "value": "T1BAE36B4633A860F5D457C279C9A28A46F7B374661731A7CF036086B62F236D57E3A332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293942, "uuid": "09b2a4d9-7ad8-4640-8ff8-7d328a02b645", "value": "09e0352ac65deda9b0ec54ee69e6e826", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293942, "uuid": "d50d52a6-b91c-47d6-a40c-7c7ad809f935", "value": "3072:GtpN7mHv0VlxThtMWOxlTPxXdoW7pFoHkoCU34inQUOi6aZLbbbbbbbbbh/n:GtbaPAlxTwPTP1dd7pFoHkoCyJbLbbbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293942, "uuid": "fb1b20db-4377-48ca-b19b-cb984d6cf887", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293942, "uuid": "57a4f817-71f5-4b3c-b830-9cf816542d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293942, "uuid": "9194dc1d-6569-4f42-815c-2eb4693990c2", "value": "682955f48641b372b85e41983e2f637358d35bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebd6a17-e710-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1767271955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271955, "uuid": "2c6c8819-22d4-449b-8886-507bd67bbd9c", "comment": "Malware payload (OffLoader)", "value": "935e797ff363a08ee130ca80d2c32d8c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271955, "uuid": "4516fe43-640d-472e-9835-04dc5b8db882", "comment": "Malware payload (OffLoader)", "value": "212e16dba635e5077e505ffab91b94354d99008d255266f0f5296605650f47c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271955, "uuid": "f30e363d-7a42-40ad-8b86-9e876e295e01", "comment": "Malware payload (OffLoader)", "value": "02b4c5dd6d955f1c9890f143f0b726335dfcf091", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271955, "uuid": "2a30c6ed-1d66-44c3-ac9c-d1fb5aa303da", "comment": "Malware payload (OffLoader)", "value": "6a60dcf1220bfc8debd7261f434ee9bfa7f2ae253231d236f7f296c6645a2d4bfc330df3818316f329b056568f8edbee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271955, "uuid": "968b2d23-f05a-4e8d-b097-6577ced54418", "value": "T191A62323B24A673DE06E7E3739BAB234493B6A13651E4C4E96E40C4CCF191602DFF656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271955, "uuid": "806852f9-b5b0-44a0-aaf8-f1563d768e07", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271955, "uuid": "8a2ee31f-6326-4930-b257-0822ed5638f4", "value": "196608:I1ey1wmLWFmqR3/1xooqc1NJO+CZaapf2+btH5yDzF+Qp/mjiDE9pkCk:IMy1UFmUtxN1NOt0DzXGt9/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767271955, "uuid": "3dd4ab28-a128-4dc4-aad4-730f9520b006", "value": 9737382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767271955, "uuid": "f7dcd970-aba3-4cf3-afd9-15c516b36f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271955, "uuid": "be87fe50-e485-4171-9f33-83d8395e7f60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113c7d27-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272093, "uuid": "c11138fa-1735-46f5-8561-20ecbbadfda8", "comment": "Malware payload (Mirai)", "value": "cc4d7680dc70764e626da0b0903f4fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272093, "uuid": "85972403-ad9c-4147-bc78-31c4eadec0e7", "comment": "Malware payload (Mirai)", "value": "224aacf9057f11e90a086061a7941d7935e09d5472641a446fc5df5764993024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272093, "uuid": "8d40bf61-79b0-4432-b361-ef1fb4b9c2f8", "comment": "Malware payload (Mirai)", "value": "9cbf3a378f1ea14961a1a451dab2c884ebb4cec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272093, "uuid": "a05f00d9-974c-4f0d-8c3a-d39edfe0e0c8", "comment": "Malware payload (Mirai)", "value": "1032cb23eb1456eda8fdc8926b0702504b33206c0bd1f2a05ade8b167879a0192522e539a1135656ab15c9c4b907fa0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272093, "uuid": "fc4c1c03-a085-4acf-a2fd-300375eb0d25", "value": "T174C3127C0237D867E6468CB8C0565DBB191081BF1FEA5C069E59F7ACF47E5078AD108B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272093, "uuid": "78692877-e870-4f3d-b9b9-74d4d0b29a52", "value": "3072:xrEqYlHozYoCFOMxRWGSJBMMdaesikbfAGDfarSf:VEpozYnSG0/kHTboGzaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272093, "uuid": "a84917dd-413c-4722-a42b-95fc629d58ac", "value": 126740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272093, "uuid": "c0ab3b89-ac7f-45aa-8fc2-c071e0ba5c87", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272093, "uuid": "0a99a7c8-2424-4cae-99d7-22ee522c252f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08632e4c-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297419, "uuid": "c2658d0e-3f99-44a1-b250-db1ef953d4b1", "comment": "Malware payload", "value": "94c02f9c4aed7ed61d750c771f572bb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297419, "uuid": "aa449200-3340-4c23-b371-20bd146770b4", "comment": "Malware payload", "value": "22fd46dc3d2215b4e00211f30c8c98440c1d1885421445206842e1839398a023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297419, "uuid": "93593294-8e2f-4994-b212-e672c5f2b9fb", "comment": "Malware payload", "value": "8e412286243e1ef71cfea21ccebf9400896f2080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297419, "uuid": "51b36620-d38b-49a5-9704-c6984430eef4", "comment": "Malware payload", "value": "7cf495b53f1a9af1c325990f47e9a61a521577aba1f246da1e75de321295740942513c721b3a10b60a96fe0813ff1368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297419, "uuid": "ff3b0234-08a0-438f-8400-3d494890fd03", "value": "T11EC43A55F8809F62CAC52976F79D869C33134B79C3EB720699144B383BDB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297419, "uuid": "84212100-abf4-4f33-9ca7-612171d453d3", "value": "12288:QGCf7kS0X+uN9fT3MGbhvuQnvgpZ6mjdgyj:5QNG3Tlhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297419, "uuid": "6e1592b7-0343-4ccb-bc25-97cab64a2ae2", "value": 565920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297419, "uuid": "f288ed94-78a9-4e4a-bb3d-91bdedc95ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297419, "uuid": "bd9c0e3e-fb66-483f-a6df-2086ce9001f4", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d6e57f-e732-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767286430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286430, "uuid": "e8edb240-efeb-40b1-a464-3aa9bb6e8911", "comment": "Malware payload (AsyncRAT)", "value": "985a8095213cedd3dbcf29bf10cb33c8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286430, "uuid": "27ce1fe7-b9cc-4ecf-a7a7-e95d71ce89b7", "comment": "Malware payload (AsyncRAT)", "value": "24d357cc71ec647b58bf02aa3005ff7246b522332d343248b4b56e82f8ef5324", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286430, "uuid": "d023b7fe-eedc-4455-a6c0-ef19b1fd706c", "comment": "Malware payload (AsyncRAT)", "value": "a41dd240ad13982a9a58aafeb9dd3c643981e259", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286430, "uuid": "7c922885-47df-4a82-b9c9-c09c69bae591", "comment": "Malware payload (AsyncRAT)", "value": "f843f23842ff4bcb96393ffb8afb9e54f97c3d3402e5244a47f0780044073eb87370a041ba229396e425eb2856844c23", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286430, "uuid": "2050f377-e8a5-4e8c-9c7e-52ca6a4986b3", "value": "T1A1534B00279CC965E2AE8AB4BDF2950002B5D9772105DA5E7CC414DB6BAEFC686133FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286430, "uuid": "aec145c6-676c-48eb-b6b4-394eb305448f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286430, "uuid": "459f1591-522e-4e4b-9790-388b6c8a7c75", "value": "1536:qTsHa0+n62T07XGbbfwvE6KKGS6bULVclN:qf0062T07Gbbf8EG6bUBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286430, "uuid": "35693c7c-586c-46c6-9362-12b05ceb542d", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286430, "uuid": "e24c40c2-ccdf-4085-b0ef-ee2a8357e3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286430, "uuid": "6456ffe4-4aee-4442-a77d-4a661cbf1a01", "value": "PraetorianCloudDefender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb03c93-e722-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767279686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279686, "uuid": "9c77fd03-0711-4acb-bb3d-e189bb55ddd0", "comment": "Malware payload (SalatStealer)", "value": "f6f48ddd62cf9fd06a3f817d5f12932d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279686, "uuid": "ccc036aa-1557-4e4d-acc4-ede82d9b384d", "comment": "Malware payload (SalatStealer)", "value": "24e3f03ee91ed871c949387221b64e435649dda3552fe51fc0b6eaecb6d9ff27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279686, "uuid": "f0b9e182-f889-48ff-8960-1c21d2992c9b", "comment": "Malware payload (SalatStealer)", "value": "2ee2d11584211859db0ea6d502fcbcf8c2bcc41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279686, "uuid": "2facb75b-add8-4b66-94e1-7c2eb5641e16", "comment": "Malware payload (SalatStealer)", "value": "0d82f42674e6d9748529da11add8746837a1e1b5d52f361f25d223c7408ed69df7999d24efbe83caafa6eab4670c0fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279686, "uuid": "0dcd9c92-a700-4c15-b38f-d08828995184", "value": "T10FC65A51FA8B54F6E9071831405BB23F23305E048B28DBDBFB547B6EFC7769118AA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279686, "uuid": "2679a1f2-7a22-4810-b43f-49352562cae1", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279686, "uuid": "65024e4d-2a1b-42a9-822f-984cbbf7931a", "value": "49152:FZLfJ8g6n7h3pVVR2UArFlw7LErFQrhxBq6ffaxQxiQPNxqPcITACzgOnN5L+vXG:vbJ6FX2jMkWMqoDG37GbTPn4WNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279686, "uuid": "15a5e051-54b8-4def-9007-de874eb05311", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279686, "uuid": "44eff4d8-50cd-40c4-b576-3ab1a75bec68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279686, "uuid": "e9b9e05a-6e40-4d24-a975-845dc45f09f6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57310651-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226255, "uuid": "7c8e65e4-e291-4387-a36e-ed7073a69f00", "comment": "Malware payload (Mirai)", "value": "3ea5a6372f7607a2bf2e3754c4138439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226255, "uuid": "a22efceb-9fd5-48cc-a235-ae048baf5bfe", "comment": "Malware payload (Mirai)", "value": "24ff0b43c58daa0bcb1e835958517cc8e580cd887291558633c7e9898a4bf18a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226255, "uuid": "e78b72df-9835-4d74-b152-52a62ac8bde6", "comment": "Malware payload (Mirai)", "value": "8f9e839444dcc83441559076a21661f5ff94c266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226255, "uuid": "e8d249ab-4109-4051-bbc8-e723286c8e2d", "comment": "Malware payload (Mirai)", "value": "bd2353d62fb0ba91cd8d6896a79ee2ce38a5e2cd3fa44f9d28b224049957f70eb2c71f5d56eead71f5d7af68548d027b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226255, "uuid": "d8ca1f90-d355-4854-bae9-60d6e1f067b8", "value": "T133F3F80AFB611EFBE82FDD3706A90B0525CC610722A87F757634D928F64A64B89D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226255, "uuid": "ff50ac6f-948d-4240-a3c9-a8f556a1ae7a", "value": "3072:3uIRyOrHsf3Ke3oGkWjUcfamSVLhPGVyJ0eInTm:3usyxf3N3DkcUcidLhPGGgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226255, "uuid": "593384b6-deeb-43a5-8afc-0b8f6fb09e78", "value": 166864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226255, "uuid": "58b46000-ce21-4574-bd57-68350ee1ad56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226255, "uuid": "550cd657-be02-456c-955b-b2f69db3d814", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f33abb-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252806, "uuid": "a6cac2d9-2919-4d82-9927-0c8767c29385", "comment": "Malware payload (SalatStealer)", "value": "12c2a1352745f8d08f1f96760b9785c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252806, "uuid": "e0553728-fa27-4e31-862d-781580e9625e", "comment": "Malware payload (SalatStealer)", "value": "25562fc1e6a9e6beb95e28a3d0fda0873dc3b4ee916f1e2cd0735efe69da77e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252806, "uuid": "516588fc-d83a-40ca-8f4e-7bde617fe9d1", "comment": "Malware payload (SalatStealer)", "value": "29755aaaafc6980693ae36afd49a814ed1435909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252806, "uuid": "5927dc61-02b2-4a1c-b978-c4504a60d73c", "comment": "Malware payload (SalatStealer)", "value": "0586581d1aa62ebbde20fc1b266e5045828857e0842d5bbc7b2cff5e242bef073fc0f9a961a62df30a72fd6361b49b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252806, "uuid": "bf1dce12-5a83-40d5-a79c-fdd271a5df71", "value": "T1ACC66B51FA8B54FAE9031835405BB23F63355E048B28CBDBEB543F6EFC7B6911926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252806, "uuid": "302d81ff-5c47-423f-816f-1e7e0007bafe", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252806, "uuid": "e80c7c9c-e04c-4dd5-ad91-2f06b9ceb5ed", "value": "49152:Yuftr407DKdigll4BSpsoIk3O0R+CfHbvlxGGRMZN+NbTicdKRjhBZVRvVSc3Lj2:X1rd7ClwL8bPonhRVSc3v60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252806, "uuid": "1bffd55d-b332-4cf2-8d6c-d90e7cc1a125", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252806, "uuid": "bc45b1ad-88ed-47f1-b21e-98a4fcb8c145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252806, "uuid": "f0aa97a3-42aa-4faa-87d9-7d013af78cb2", "value": "5d43f98fa585cc710f69ea2c542decc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c329a1-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226089, "uuid": "e33beea4-92b4-45f3-b2d6-8f3927134ccf", "comment": "Malware payload (Mirai)", "value": "3f495073085c8439335282ad90bd62ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226089, "uuid": "4d0191c9-7dfd-49d1-8b1a-74bed9c3cfc8", "comment": "Malware payload (Mirai)", "value": "262e02dc9857a0d5c5aff4445d092edf78d02c46a4f48548064bf5db3a6658f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226089, "uuid": "61014474-2c43-4e78-8816-a5e946bfbeef", "comment": "Malware payload (Mirai)", "value": "f68b3ce84cb6e02bb2cb296113b6f6ed558ec2b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226089, "uuid": "c522b8c3-6c14-41ba-8c54-848c85466da5", "comment": "Malware payload (Mirai)", "value": "8feb9e32e5ff09569e29584f87ae32ca26d6c31f3807e35a63245b5b02baf395f0e03ada1a3ba19f0fd4d967867cdb05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226089, "uuid": "e46fb0e6-a74a-42c8-99fe-1f780e81728e", "value": "T15473D986B8918A56C6D512BBFE2E118D33235778E3DF73139D105F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226089, "uuid": "18f94513-d98b-4537-a9d3-e3c7dfc44950", "value": "1536:aRnxaf8a/aUoqweM+bAqKIvosmaHweNEWe5u7zQ9L38Mtiz4AAWhHu+7R:Jf7/geM+bpK0oVaHweNxe5uh4AAWhHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226089, "uuid": "74a46026-677e-43ca-864a-32a087d65cfd", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226089, "uuid": "00bdc0fc-4a20-4c36-b268-2eb8cc8302ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226089, "uuid": "72e50307-4f03-4fe9-a4e0-b85b3d9ba61a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec97ab78-e76b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767311116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311116, "uuid": "6400b60f-95c5-4289-a260-673b41bfdfb2", "comment": "Malware payload", "value": "b879e7de5f0f7c2c7013d755cfc59aa8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311116, "uuid": "aec8f21d-bd89-44d1-a786-5d4f576f353e", "comment": "Malware payload", "value": "2683c16a807907fd372e4415aaef1d1ffdf265bb1abae1f4329813b09eb44dda", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311116, "uuid": "2eb30b72-d4e5-463b-bee9-e238861f5367", "comment": "Malware payload", "value": "26efd305901009176467f741f7b559abf40e155b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311116, "uuid": "8ac4dc33-e9b5-4bba-bb68-682d40905b72", "comment": "Malware payload", "value": "f7112458f1483f2727e5281cac039e2b6558fe141e844b91fbaaaf1dc449d4d26590113b4cc19d8f6a9632f314dbef4a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311116, "uuid": "be8903fb-c1a6-4510-be87-36d227e9d0e1", "value": "T1BF060129E3E812E8E577D634CA656232D67278164770F5CF0A99C2592F73EE09B3B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311116, "uuid": "c1b3dfa0-c18d-41e0-ba82-c0e335878bb9", "value": "bc7b3218a10bbc5e849eff23490d7378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311116, "uuid": "10da2a19-de52-4a87-907e-d2fc7b82c87e", "value": "98304:LwHQZ1N4NyVnpHLSlZNOOrusKswIubSqLUI:8Ha1dLOrusNwtSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767311116, "uuid": "294750c1-cda0-4025-965e-6372136191cd", "value": 3953664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767311116, "uuid": "bc0c1315-dd65-473c-b32e-ae48ff9c0921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311116, "uuid": "1bd1f649-4f74-4c0c-8fe6-86e1172e21f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723901b8-e70c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270109, "uuid": "e28d11f0-ba91-4aed-a94a-acafa33564dd", "comment": "Malware payload (Mirai)", "value": "a7ec2d83225cdf9d68c530de67811e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270109, "uuid": "b1fc6c1d-8ca2-4134-ba68-3f4fc1132f69", "comment": "Malware payload (Mirai)", "value": "26e8c028e6511c5f6c844696830163f719a0fa8bee656152b7099d85eb0b40fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270109, "uuid": "b54b0ac4-8c9a-48b2-8f80-929272b18184", "comment": "Malware payload (Mirai)", "value": "3f54dd3d9b165e71c32c79639192393f235b3d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270109, "uuid": "c6af3910-2281-4a7f-a39e-3dc675bd75e6", "comment": "Malware payload (Mirai)", "value": "eb8fc98f130520ee59ec72596b5cf357841363b25de909817d4792247a3137dc34d18836b2d073d09a817ae566a80b7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270109, "uuid": "27e36cd5-7b69-40da-b392-2a3362ca7f3f", "value": "T1F934E80ABF610FF7E86FDD3752EA0B46218D940262A83B777674E918F54E24B09D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270109, "uuid": "7eed619e-7339-4530-a8c3-71dccb1cf931", "value": "3072:GAGIDiSalfQwyWBaGO6duQ7/Y5DsUfaz/rtJwoAXqgZlS4:wCijdfyWBc6d970Ez/rnwo2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270109, "uuid": "1ce8f028-f220-47e3-ad1e-eba72c253360", "value": 248844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270109, "uuid": "c3d02c82-9d6b-4a3b-af3d-2f883ddaded5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270109, "uuid": "b354971e-2243-42c4-8512-b432919dd570", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449a5b9d-e732-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767286353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286353, "uuid": "4d822629-8d7b-483a-856d-2f27d9702956", "comment": "Malware payload (AsyncRAT)", "value": "08f6d21f3052923e0d0197174cd51cfe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286353, "uuid": "c264ab4c-b00f-4c60-9513-fcfa32274747", "comment": "Malware payload (AsyncRAT)", "value": "27070550135f980a9585ca41e6b50be699cfc67ffaa356468a3143cc1f47f344", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286353, "uuid": "eff72146-fcf9-4d3c-9419-1545bc371f4b", "comment": "Malware payload (AsyncRAT)", "value": "4174549179f3813798c86dce5939a5a6068fc35e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286353, "uuid": "c3970331-1d09-4e42-84a3-122a0c1937db", "comment": "Malware payload (AsyncRAT)", "value": "9e0af0c9f4ae0a5e4275ad04714a37f8a2ee527c193d3ec5295c364b755eb0d7815e32975496fe70df9e52b86825a170", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286353, "uuid": "e9eee5d0-0358-429b-9b71-b4a5f3f755e7", "value": "T111534A0127D8C965E2BE8AB8FCB2550042B1D9772102DA5E7CC414DB6BAFFC656123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286353, "uuid": "4d48dca2-d17c-45da-80c3-d2899edb67c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286353, "uuid": "94529ceb-e5b4-4fcb-b7e3-7757dc73bc46", "value": "768:qv3Bp9qHZiP7CDiq9JlDSv+8UqEzZrdDH61+ySCv/mqb2nRpwH1o/c8GklduVc6c:qTsHa07XDaU2bbUw2BGeuVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286353, "uuid": "d0c93736-2c97-43ad-b882-80c2db098ded", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286353, "uuid": "ef7195de-229b-495f-a86b-2fbbde3af613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286353, "uuid": "666760a0-ae00-438b-8158-af3efc7f853b", "value": "PraetorianThreatCommand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e70480e-e736-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767288168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288168, "uuid": "3bed4d55-19fe-473f-9080-2178313c6cd3", "comment": "Malware payload", "value": "90f116907c45e9c4bdb24129c0867fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288168, "uuid": "ac94dd84-e848-4442-bdbb-32481708e36b", "comment": "Malware payload", "value": "27e2fc736f544a759216f15e900dddac91f0e8c7ab4821cca820abdb5e2342d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288168, "uuid": "30e80aa0-905e-4e99-8085-443218093968", "comment": "Malware payload", "value": "47e12bd06468189b281c34c1dc83bbced55c4118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288168, "uuid": "857d3770-06c8-45b8-834a-70888e713272", "comment": "Malware payload", "value": "1bfb0c683437f5ad64394d7c60f9a4ab447d2462a6ae5037a11e87ddba652c951cb6fbc0d022ad77b368a35f5fdcca50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288168, "uuid": "d940267a-3693-4e2f-ab9d-7a0090fe492c", "value": "T13E086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288168, "uuid": "7b11dc06-3018-4f06-9108-6aa1ed6d2640", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288168, "uuid": "afb2afac-d68e-4412-a65d-af108623e1e5", "value": "393216:Gs/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+1:GEYGD7sJYgNukUB4S5rs3wbpLLNN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767288168, "uuid": "efb255f1-7738-47a8-a35e-a51f745b18bc", "value": 82177013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767288168, "uuid": "f0c6a5dd-d383-4ca3-a4c8-1142fc693c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288168, "uuid": "a19e07bc-9cc9-49ce-8486-fdda479a8719", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99432ae-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233372, "uuid": "ec906342-22e2-46fa-ad33-f445d1bf4956", "comment": "Malware payload (Mirai)", "value": "ebf7de4b8a0fc370700b491f7f157c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233372, "uuid": "b8fdcf6f-ef86-4069-9fbb-3f8d00c05e9c", "comment": "Malware payload (Mirai)", "value": "27f25ef8df96dc870f568cc8d6d5921f14ce1f25590296f8b72b91f8eb217c60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233372, "uuid": "b204d9c9-7fed-4980-be48-0535ac61ef12", "comment": "Malware payload (Mirai)", "value": "fee148e5765917d14e19f78bee82c054e83941d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233372, "uuid": "02dabd89-2619-4b2d-8520-b12450ee57a1", "comment": "Malware payload (Mirai)", "value": "705630fad5eb3192918486cb9a77dfa7efe00c06551cac324b10ab71c49c3ad6e1e6927ef394cef1a4167a5316f74c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233372, "uuid": "f5025478-d312-4f37-9736-36c161f8ce4a", "value": "T16214B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233372, "uuid": "e9627853-9cda-490b-a541-b23b5b7a93be", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1PMDV:QDy7dCaWalr3bt+eX7EMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233372, "uuid": "7e33473e-61d5-4897-9343-eb491bdaaad6", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233372, "uuid": "f27c7145-2b1f-485b-8327-92c66033b11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233372, "uuid": "f9249650-0644-4f2e-9c12-e817f637cf44", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e2ab55-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767226066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226066, "uuid": "06c1b473-86f6-4eb7-ae9a-bb89f86943ff", "comment": "Malware payload", "value": "fea7fc133353ae2939899e5789408c01", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226066, "uuid": "5c712695-98a4-4cca-8f46-f63f069da88c", "comment": "Malware payload", "value": "282c6b04dd8e995456a16dc9538227094ef09778a43a815c394a20e536e76147", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226066, "uuid": "b9c63fa4-587a-4d7b-9ac4-40cbe4fb8986", "comment": "Malware payload", "value": "f653534339b5a6674c6badfa9d8f3460355bc70d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226066, "uuid": "a64d9f79-d39f-4ad6-9061-ac95d317b1c2", "comment": "Malware payload", "value": "73b97275653751206f85da24ec947d9f19d2ccf0f709c90182fd2e8061dd49d69b64d6716169702a466fcc91fce44915", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226066, "uuid": "a0598ef9-415f-46da-bca8-90699784006d", "value": "T122C2F73AC894AFF00B2F61A1EC4B3A5545954326B6783A0D79CEE5EC2B35310CF950EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226066, "uuid": "75d27c7a-b53a-436e-a5f1-5f852e32a14e", "value": "768:KVRnFfYBKwdLt25sCXHciHlSaNoUKaUUG/h:afYBKwdLEVXHcicaNpKJUG/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226066, "uuid": "4f8be293-88c8-4efa-b0b4-2703a668e424", "value": 27464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226066, "uuid": "a42f2520-30de-48a2-be1e-6af8c2e4df1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226066, "uuid": "330e005c-2e71-4d7a-9936-8e3220fadfaa", "value": "gosth.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f4ea94-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226809, "uuid": "d67fe987-eee6-4d1e-a088-84a6939fda14", "comment": "Malware payload (Mirai)", "value": "9df55c05ad595c1b568fbbd006fcbc4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226809, "uuid": "a8eb86b9-99d2-4ec7-9b70-36efa4ad0e74", "comment": "Malware payload (Mirai)", "value": "2918740f396f213608c9792334ed40ec835d21714e56719251a432be24ab13e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226809, "uuid": "a62329c4-8610-43d4-9a18-a830eeafaf44", "comment": "Malware payload (Mirai)", "value": "ac06484a0df26e20b22e07edc48f44b18902ab15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226809, "uuid": "79d4895f-053b-45e7-bd3b-8af78e37f71c", "comment": "Malware payload (Mirai)", "value": "fb6c265a082073a3e8ca02821e8aa0fee8874dcd3698923011315f551bf8d680640866cccdf44aafa57cade85d91f160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226809, "uuid": "0422bd62-836f-49fe-b80d-7cbd96e10af2", "value": "T13873B61A2F259F6DF76C873547B78E309798239627E1C241D1ACF9019E6034E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226809, "uuid": "8b85c309-0892-4214-9994-e89f91fd08dc", "value": "1536:a6tWzrQaJ0oc6cf2YCdu4PuyzWxFE+pnH07HGF7HHqP4niLz1uM7RC:14zrQaJdc6cf2lN3Z54niH1uMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226809, "uuid": "2b76fad2-04fd-4b7d-be8f-6db3de4e4674", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226809, "uuid": "6a8eedcd-3f25-4f28-84ba-fd60b6a6e56f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226809, "uuid": "fef20742-63ac-49fd-b873-507a89d2e1a5", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2938e440-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272134, "uuid": "0fb01884-432d-4122-9744-b8c8d254a55d", "comment": "Malware payload (Mirai)", "value": "da53b76de084d1a5095296a1dfa14c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272134, "uuid": "67e9a7c5-1936-4ce1-b934-7a762f8e2e32", "comment": "Malware payload (Mirai)", "value": "293c42e21659ea2020eb2fb250cdda511cf9ffcf54b42caf0c6bea1559e8d8a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272134, "uuid": "4d755737-fd1e-4ca4-95e2-0276805bf2a1", "comment": "Malware payload (Mirai)", "value": "a1d267d2c3f35f1edfb87bac9a7e2c1addfc2708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272134, "uuid": "df52ab17-75c7-41ba-a438-53162a687a50", "comment": "Malware payload (Mirai)", "value": "ce86365001625270dec7b2a4541b1f09dfa2b6ded3cf06d73c89deec059bd3daaa6a989b6503f8663b37294523ffb67c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272134, "uuid": "d3858771-1080-4035-8455-c93b090216d5", "value": "T16D14E85DE4608B3AC7D1217AF795428D33735F28EBEA330949256B343BDB6295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272134, "uuid": "03cc1940-dd4f-492f-b980-24e5176bee8d", "value": "3072:rqsYZPDmLKJullvgIEEWVWsL1NrUU2dzYsVs1DbXcs+7GH:rqsYZPDmibIEEWVWsL1NrUxjG1Db/+7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272134, "uuid": "96a618d6-7f9c-4b77-bc6e-c2590c9b6bd5", "value": 196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272134, "uuid": "ef7da147-e9cf-46c0-a352-156755c2a6d6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272134, "uuid": "539f9af8-aecf-4e78-b059-05df334fb4f0", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d7d63c-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767283006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283006, "uuid": "2badff81-46e8-422c-86b2-925a5b91c117", "comment": "Malware payload (Stealc)", "value": "96ae1ca0a1ccc0dbcf6ffc678e65a009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283006, "uuid": "32865e18-c5e6-4f4e-8dd3-dfd824bdb8fe", "comment": "Malware payload (Stealc)", "value": "2a2c7338542c0c6c4918a24e58ffb16c487b825a462dfc7202ad49ec44918dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283006, "uuid": "a913ca8f-93bd-4054-8f92-806d50206c84", "comment": "Malware payload (Stealc)", "value": "17dd6b395ab6c1f09c803a05e336c4b491ecc3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283006, "uuid": "bc799a85-ddce-4c3c-b576-9d2a811f1f83", "comment": "Malware payload (Stealc)", "value": "dc056436b2b2cb8e652bc6c9fa67d17c7d4026662ad112727ea07a16c6d522c13ab39f9592c834177b28c3835ca19f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283006, "uuid": "40a59963-d5d5-4dfe-9bb6-91c96006bb6c", "value": "T124C588F0AE01D4C1F57E5F7AF3ED7908A1342227EADD5A4A00A466591EF6A01FD0ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283006, "uuid": "1b033fe0-58b3-4876-a7d5-87f3235747f7", "value": "66506cf48bfc3b0d79a8e3790223e69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283006, "uuid": "96029e52-03f2-4f84-8713-cd6928561326", "value": "24576:46NxZWMOsuFTAa5bCIcY/Fq+ig/NrWoXcftEAxFIBDJ:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283006, "uuid": "0046a5ac-5e7e-47e3-816d-b564019633ea", "value": 2671616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283006, "uuid": "bd31870d-b50c-4c19-bf42-6eeeb3bac674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283006, "uuid": "7043e60a-9f43-4068-89b2-da62ae8ec18a", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d60be3-e734-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767287294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287294, "uuid": "507d5386-f34f-4ee5-baeb-fe7867ddd09b", "comment": "Malware payload", "value": "f289f3912763931811ac8077204980ba", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287294, "uuid": "472a43e9-77c0-4ce5-b2fd-fccf80412938", "comment": "Malware payload", "value": "2a54d4e2cf5e15377b127c7c0a5d47f8ffde9c95ade9452d84432c797e1ffe3e", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287294, "uuid": "ca669e28-5cb7-4787-b8c9-1d55d7abc7c0", "comment": "Malware payload", "value": "eca20c3a7dedd5d08d8654bb9dad2606e0a477eb", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287294, "uuid": "1d85f6d5-be9a-468a-a7fa-a7a57120ade4", "comment": "Malware payload", "value": "a8de856acbe359bbe2755f121881666316873338386c78133a32fbd1c694263f3da35821a207c3753b787587f9d7a8dc", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287294, "uuid": "b7dffb28-e02d-4e80-9097-465c099e2a72", "value": "T18DA423F3EB9B4036C6A1F2BF9E0F81196F8B113ADD1023B96887DDD2848B1D446D754A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287294, "uuid": "191c4d02-7d29-4811-a1c2-fa09171ce74b", "value": "12288:4UjFxfBLJdNrrF5H6xiX4zX9kEL4m2U7xK8sng8WCK:4WrNvransm2U7ong8W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287294, "uuid": "c47eee5a-a845-41a7-b44c-6fea985e2dec", "value": 481177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287294, "uuid": "f6cafe3f-8bb9-4e05-976f-f6fb27994c30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287294, "uuid": "23a63118-48ee-4e2c-b892-f9b7733915e4", "value": "BEHO73UT-YPKW-5KPB-JTGK-QFJMJ1KKI2I0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463ffbe6-e715-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767273900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273900, "uuid": "de264d46-14a3-48a9-bf26-f5b71fe35ec6", "comment": "Malware payload (Mirai)", "value": "ab895960f7f94f73fd1dcb7843ee103f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273900, "uuid": "1208a1f5-05bd-4946-af4d-257b45ae172d", "comment": "Malware payload (Mirai)", "value": "2b78bdb9f9b7cb1b78c4e78a8890c2fcc1c8558391592db84a97b0c0d76c0e20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273900, "uuid": "d29573f9-ff96-417b-ace1-0eb63f3c7d57", "comment": "Malware payload (Mirai)", "value": "d3539381c8d2aa99172a0a4f0d90c913e6d51d60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273900, "uuid": "ed21f37d-261c-4e54-b904-9a852d0c1d03", "comment": "Malware payload (Mirai)", "value": "2432e01ee02e1787f8fca3cea39c4e31a487937aada425848413808babab387ba77975ec67ad9f199b28153c80132450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273900, "uuid": "c5a69c71-701a-43ea-bd29-b8459f4140a2", "value": "T12E044A56BD92DE23C6C521B7FB6E82CD731713B8C3E73202CD255F21668A86A0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273900, "uuid": "6a1c7800-6e3f-496a-b3bc-71cbbbe3aa17", "value": "3072:9THa/a15IWED6TyrBprXdbKjK2sP5EpoE42y8+o2RjmU:dHZzJEeTyrBRdGK2sREpob2y8+TRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273900, "uuid": "ab8a1498-5813-4ed7-81e2-c3a15746763e", "value": 185888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273900, "uuid": "32cc2370-49cc-4dc6-bedb-83dc6155565d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273900, "uuid": "53ee523c-404f-4fa1-93e3-3468d08070a6", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8306af9c-e716-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767274432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274432, "uuid": "cbd855cb-8ffa-42ec-8407-1975eaf004f1", "comment": "Malware payload (Mirai)", "value": "4f425840c4b99b40395ed67bd74b3aed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274432, "uuid": "802a583c-1d2d-460c-90c8-d2543207aad6", "comment": "Malware payload (Mirai)", "value": "2b9edd3aa6197e4b1d8d8b8913cc7fcb54a02b6fa28ee7fb57f0e262e0ea2484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274432, "uuid": "590ba113-2f21-4ad0-a3e1-fb400396f11d", "comment": "Malware payload (Mirai)", "value": "78def698519d1f15fd2fed80c1580efc2cf9e50d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274432, "uuid": "fea2f6ed-a975-443d-a3ee-70edc04bf003", "comment": "Malware payload (Mirai)", "value": "de0b2936f492ac15bd8558d09fb057a0b5435eb4ffeab8cf435f12ed86e01bf336c4e87786812d9d16aa64eb84620ee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274432, "uuid": "acb69279-2c90-43d4-bf4f-bb355e418620", "value": "T18FF36C16F74080FFC88AD37D46EFA236D8B2781D1239765E6794EF157C89E20362D681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274432, "uuid": "ddcfeb1a-c6e0-4e00-bf30-c479ac2d4dfe", "value": "3072:bmO5l1aJO3RXHP8juOg9tlOXDMDGg1gbRmmppfcRo:bmO5l18OB/8juft0TafgbXpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274432, "uuid": "22737f9d-7d65-4711-925c-7dd7fe8f8c24", "value": 169776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274432, "uuid": "668b768b-848c-4b30-b459-1a1290b35ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274432, "uuid": "e3530771-ea79-4731-83ed-78d8a747ccc2", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47710847-e715-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273902, "uuid": "4f793df5-132f-4cca-9b25-d85760050d1b", "comment": "Malware payload", "value": "1aebc3960a9943797d9949ee22bffc83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273902, "uuid": "48474ef2-3993-4b93-a878-e27b5ea4ca6c", "comment": "Malware payload", "value": "2bfd782322711c3526dd6816d2b262714800ee70f67455a92957325ec0f9147c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273902, "uuid": "db42041f-af5f-40cd-97d0-f33ac039f2ba", "comment": "Malware payload", "value": "b526ea8449979f4ea0c070ed1db31b2bd4392440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273902, "uuid": "a2f07b05-59c2-4444-853b-4a6a0be8e699", "comment": "Malware payload", "value": "a05f4f3d7020accb1ea141e855e1c7ce5af290b5b14222a3df7f1f6428ae09675e38e30ffb310815898a078acb8b9688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273902, "uuid": "9704ebbd-0e70-473b-8f18-36ec0fb4346b", "value": "T1AE086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273902, "uuid": "7ae663e4-ddec-4c7f-a808-ded1e53f4ab1", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273902, "uuid": "b4b10eeb-c4e2-47d3-9ea8-2e5016402413", "value": "393216:5s/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+0:5EYGD7sJYgNukUB4S5rs3wbpLLNNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273902, "uuid": "de1a8681-6882-496a-9b99-cb4c907d7b9e", "value": 82084163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273902, "uuid": "76737336-b495-4c05-9abe-7e785e8a1236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273902, "uuid": "f1e1d9e8-6ac1-418e-ba12-c6fcd50f3756", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51124e6-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228130, "uuid": "010677f1-44c5-483b-86b1-e4998ba48bf7", "comment": "Malware payload (Mirai)", "value": "9df32275f1436db52a5664c9c77a3ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228130, "uuid": "d0c51440-09b1-419d-9a28-84b8b2d070c2", "comment": "Malware payload (Mirai)", "value": "2d128aa9e430cf319082162224aa59d769f47228397609161b21555e578f40ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228130, "uuid": "b7d98331-ba87-406a-a7bc-760fa380ee76", "comment": "Malware payload (Mirai)", "value": "afbb39cfb6771f3fa2e4968d5d3556673d7fd826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228130, "uuid": "44f0bc05-aceb-4400-924a-54d7598570fa", "comment": "Malware payload (Mirai)", "value": "488ddde80a23eb51c3040fee23364f7e25a3e372172adfadb4d88111daff0f7d456e86258677d821768312fe5f5286c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228130, "uuid": "926529a7-63d9-4cdd-8501-6b6d48b449a8", "value": "T1FF237D417308C553D2975EF0293F2BF0A7BE9AA02154E385B50DFA8D81B6E336147DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228130, "uuid": "9cbb081f-d7dd-43ec-ac5a-80435c572eff", "value": "768:DUsQpGgQMHys5lrkPr8lua7s0VchY6D3naLpu+7Rn:EHn5SPy3i1D32pu+7Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228130, "uuid": "d322af6d-6740-4e63-86b5-7a42ac4d9964", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228130, "uuid": "1a62fdd6-5d88-4b3d-a966-1b06f878032f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228130, "uuid": "388ee011-4eda-4936-b8ac-b57b8a4e62b8", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a69b9c-e6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229879, "uuid": "c5537957-d42e-4032-ac11-a304e7c3a499", "comment": "Malware payload (Mirai)", "value": "8fa2da51895ca1387eb3693c39feb13a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229879, "uuid": "9ff459a5-33aa-4968-894e-2fb4893a499e", "comment": "Malware payload (Mirai)", "value": "2ea71feaf2b3ddd344c82ff1f7b40e04055b6494946b5c097eaa38a673d7b10b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229879, "uuid": "57033a63-bc5d-47e2-a25f-636a34cfc91b", "comment": "Malware payload (Mirai)", "value": "e3c0079b057bb87b0caf8cfffcaaf2c9919431ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229879, "uuid": "af965eb7-6d41-4daf-a087-caa0358e2a0f", "comment": "Malware payload (Mirai)", "value": "68ea13091568c3c7bc1775ddcd58f8712b8e6038da7bf226524c9531cb0ddfedb862842c87259f31221ba0862097a878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229879, "uuid": "8c932abe-fc01-4f93-b49b-9a4fcee1715e", "value": "T101535DD6B405DF3CFC5AE67AC1120A06F524734596830F3BA3AAFC935DB21988D16F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229879, "uuid": "43727380-b84d-45eb-977f-2c1c6ae1a070", "value": "1536:iU7mz2NSKOIBdWOb8WdAc1qzi8t75pZSbkQlRaDPC:iU7mkWObPAcmR7sbz6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229879, "uuid": "0817e914-e918-4cb1-8b48-3f8d2ee0f517", "value": 64216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229879, "uuid": "bb053241-d0ed-4fe5-8341-ab059e7b1be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229879, "uuid": "b7b02090-f929-4446-9557-16bd24f4ddd3", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50777fb2-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270481, "uuid": "5d5327e0-ee49-417b-ac51-bae98811f944", "comment": "Malware payload (Mirai)", "value": "bd1fa745760bb84dcfb4d399ddad1e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270481, "uuid": "bba5996a-7caf-4bb9-91f9-f4dfc57f9eb0", "comment": "Malware payload (Mirai)", "value": "2ef537a8d57d2fbf7d169ec9e50e4a56af16845c59c3a16d32c7412d479e1c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270481, "uuid": "b9cb07ff-2d77-48eb-b477-d70e8bf03d2a", "comment": "Malware payload (Mirai)", "value": "8ef6ef995713b74f09085babe1e2fcd611f0fe94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270481, "uuid": "fb8a2af1-2659-42e2-9fbf-cccc147dbb6f", "comment": "Malware payload (Mirai)", "value": "a9a498e702b2fa47bacec1014a47babf8a5d85ffb98bf22aadaedb6d795822471472a3ca8b3d5d75fbc8ea741d88b722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270481, "uuid": "f1a67c15-2fcb-4c06-8e01-204211b49fc0", "value": "T1D2432A96B801AD7CF94FE6BE94234D0DFA21335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270481, "uuid": "0e533892-3fa6-45fb-81b9-4af0125a1162", "value": "1536:oFMAMFlwZA9UwTrPE3wqyIE8WhibBqKpnzC:zTFlwZSUwTYlfqjKpzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270481, "uuid": "b1f87211-007c-4015-9b01-9fe48ccf5a21", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270481, "uuid": "163ac862-e447-4be7-be59-afeb2c913818", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270481, "uuid": "4012407b-2701-4aa1-b4b3-9cc2d4b1cdd0", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bf1b7f-e75a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767303666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303666, "uuid": "5346add0-5009-459a-9442-bd171d0405b0", "comment": "Malware payload (Mirai)", "value": "839296db1d5c5ea51af28e980613ab43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303666, "uuid": "2c9e49ed-385c-44c3-b80a-d71d7cb29642", "comment": "Malware payload (Mirai)", "value": "3024aebb877fed531c1bfb9604f6adb22e0a2947963929da2d37c4208188c989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303666, "uuid": "67339fa0-3c45-4846-95a4-faff4cd341e2", "comment": "Malware payload (Mirai)", "value": "9579a07c515d8704dad9bc838ee31dade349d480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303666, "uuid": "6589fb93-8480-4f9c-853e-f0bd2afdd4e9", "comment": "Malware payload (Mirai)", "value": "797dcbcc3c10e8f6ba07d8c81304595928f7b32ae93362ae43b21e7b04d02b4321409f623d47d560a4ae8d81e1e1f62a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303666, "uuid": "107c5945-68c7-4b35-9032-3780906f82fe", "value": "T1A16312FAC4EDC815F1C7A1738BCF5E0652305EA6D64C9A535AC0F422B5F6F58026A783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303666, "uuid": "080360c6-febb-4a53-bd3c-fb601af590db", "value": "1536:ylu8/AOpnrJofgK2UV13Ng4RCstd2mss90ie0AMMm4Onouy8Hyb:ylFpEb3xsQne0AMMBOoutM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767303666, "uuid": "e2e25b8d-8f08-4783-a8f5-7882da0bbf8e", "value": 68528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767303666, "uuid": "8144bcbe-4934-4654-861b-1cae15e3226c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303666, "uuid": "a641051e-5e3c-4b73-ae1d-c83cce39f6d2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb21d5e5-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297799, "uuid": "237d83a8-af7f-4bd8-9934-838f26bf1c98", "comment": "Malware payload", "value": "1311929f5e0b5ab560b141ada5a27ba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297799, "uuid": "e728c9cc-b64c-4b2b-9526-52b616b77649", "comment": "Malware payload", "value": "30698ecb29da7b8a76b9bcbe783d38ad7c6d98ed1155a8d0f7897f2644408a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297799, "uuid": "1168936d-0c36-4ca9-8d82-e8e9387f8873", "comment": "Malware payload", "value": "1050e813862261ef572ac204b94d1013cd3d6bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297799, "uuid": "f0d2c767-8448-46b9-be46-8977bd445fb5", "comment": "Malware payload", "value": "9b57cc656cbe81b473cf73839258da8b75f81e8bffe6133745619ea0c2543c75e6e019f83226193da6e13fefc6212814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297799, "uuid": "152c9d6a-cb72-455a-9b76-d33e463c4cec", "value": "T177F47D62B7208FA4E365D67005F38B156AA412E20AF795C2937DC6107B50B6E2C1FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297799, "uuid": "d8ab33ca-8ac6-4465-a9b0-08cc12f9013c", "value": "12288:Hyj0Z8Gl+UsysRGhRZ9Q5yS2CglagpZlZMPHC:sM+D35ySgJWPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297799, "uuid": "d74cfe6d-8df8-444c-b625-b17040888cf3", "value": 729940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297799, "uuid": "b8b72bb7-313c-4a65-b0dd-11aaee1aded8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297799, "uuid": "1bbdf8d9-6a9f-4ca6-ba67-307aaaf9275b", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6e48b2-e6af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767230073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230073, "uuid": "ae2689b3-35f6-40d8-81ad-5ba6a8b2efbe", "comment": "Malware payload (Mirai)", "value": "385839052835252abe0b6731a984ee16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230073, "uuid": "7b2c7d71-a999-45bf-b5b7-bbe39f9cc433", "comment": "Malware payload (Mirai)", "value": "308fb8dabe4a611b3891fdbc5bc2668ebd460433fa19c2eb615b79c481f0efe2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230073, "uuid": "06d2f1d8-4428-4971-953f-ef149a60cb8c", "comment": "Malware payload (Mirai)", "value": "93ef6cd758ab7d5f7888bbc41aefccfd621baba4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230073, "uuid": "d2a8a6a5-8f82-41b0-8281-f204bda0abd7", "comment": "Malware payload (Mirai)", "value": "6afaa0b1ad6a877db655650ac65614a328b36576eb55f75f9e57b8682f3f94dc1a9feb9b4ec1d7cde222c8dcb87fa6d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230073, "uuid": "f2a45f95-31c6-453f-8112-97f0c7dc97ac", "value": "T1F581948C21706B74387A5D3359E50D246283C3E2A6A61F916FD6BDA14BCDE373F885C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230073, "uuid": "96ba8242-e44a-4767-ab2c-addde49c852b", "value": "24:vB7m7M7m7TZfB7m70e7m70dMfB7m7h7m7oShBfB7m727m7lSqJ1fB7m7Ke7m7Kd/:vEpIU3xgN3Q0JIPxv/qwxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230073, "uuid": "5de016d6-d4b8-4b79-aca6-d6e27be90d30", "value": 3937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230073, "uuid": "ac6b0a5f-34d3-4451-981e-2329e5603977", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230073, "uuid": "097fe57d-90de-4f0b-8b35-244a89767f79", "value": "ohsitsvegawellrip.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6a4c73-e732-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767286255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286255, "uuid": "1eb051e7-880a-4c99-bb29-3363bead13f0", "comment": "Malware payload", "value": "d02d31c729b5416c5dd3ecfa72f256fd", "object_relation": "md5", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286255, "uuid": "cde8d4a2-3ccb-47d0-9a36-2498ed21fa9f", "comment": "Malware payload", "value": "30a1cf488aa5ff72dc76d4a9d9409b5a148c4b3a061e742f52b48348450797fd", "object_relation": "sha256", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286255, "uuid": "823c57d4-491d-44dd-895b-3cbf57bb1db3", "comment": "Malware payload", "value": "d942fe57e9604d4acede0a48028d8078cdbcf9c7", "object_relation": "sha1", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286255, "uuid": "22e194a8-bb95-4ee0-94db-e3dec3b8d45c", "comment": "Malware payload", "value": "75a280eca388998312af688e6f7a25973490cad6beb0a2b10523186bd2a2151b4dc5391b8394352fae8141b4ef2a3542", "object_relation": "sha3-384", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286255, "uuid": "13e7c2e3-1654-496c-aa71-cf82c41ff25a", "value": "T1B9C5454463C2B8810397DBBBBB1BB4DAF46A0DD97584084BE215F890F474B1AEEF1971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286255, "uuid": "749c19e5-02b5-4a00-8d51-0866d73c6a54", "value": "24576:40pOt8rbGm6JzHE/cg6SfoZ1JQakD6dO4iPfi3M:3QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286255, "uuid": "716669c0-ddd0-4c81-8b69-2ea8d204d804", "value": 2547426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286255, "uuid": "15ffc838-d91e-41e0-b1af-561aa99cfdb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286255, "uuid": "e418790b-c06d-475e-98c2-a3108c86b2c8", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af5ba9c-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767280404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280404, "uuid": "8911045f-5d89-467b-8f36-3ba8ca184fa1", "comment": "Malware payload (SalatStealer)", "value": "e7fe2c19a483c583c3f6eb19a897147f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280404, "uuid": "b4850d6f-9d86-4a34-9994-1a2c68602655", "comment": "Malware payload (SalatStealer)", "value": "30dfc41723c5a940f7b8d0a4b6800589531f4f7765d38afab83dfa9d2cea5ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280404, "uuid": "79f3aa6b-aae6-4330-9fe7-6cdd095caf5f", "comment": "Malware payload (SalatStealer)", "value": "86f6bc23a822cef291e0c292fe485860faa34dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280404, "uuid": "070c3652-e8e5-4c76-a6ff-51db28af2d24", "comment": "Malware payload (SalatStealer)", "value": "3e6ed77cba1399b1f06d2e94ed9bd130506a5a78644bda57b4b7eb0b8e99c9b63a0ae26fa7580441090f4e9733d5c2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280404, "uuid": "c38cb11d-214a-415b-81b4-c050feb6c9ce", "value": "T1CAC66A11FA8B54FAE9031835405BB23F63355E048B28CBDBFB547B6EFC77691192A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280404, "uuid": "7d6899bc-b254-4aab-902e-a8a510f57870", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280404, "uuid": "a09325a2-7f8f-4145-b67b-11794919b74a", "value": "49152:YcAYn+dv58ZtyK3LfDll4tkWQqme7LKCVGoaWTHTNMI77fgxAp2+aVT1iGmx7kd4:pnnCvZKrqdJ9vpaHtmx7kNxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280404, "uuid": "a3c5d66d-6cf8-40af-af36-52f111072e85", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280404, "uuid": "f6788b73-2d0c-4c8f-bd78-5f2e3d188a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280404, "uuid": "9bacbc61-755f-4b5e-a1ab-8cbfc3f6ac09", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7940419e-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767231466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231466, "uuid": "3b33c368-a269-4d70-ba02-7b9aeb717c6e", "comment": "Malware payload (Mirai)", "value": "9459665d19594360ec3e6a53b61b8c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231466, "uuid": "7d6b5ec5-6107-4e40-94a5-46b45f28d95b", "comment": "Malware payload (Mirai)", "value": "3143eed8a14828f505096ae995dcd0f3761308f0034dac2f29c73b3a8c7c58b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231466, "uuid": "e0f75200-b3bb-40f9-8499-25c1d5644063", "comment": "Malware payload (Mirai)", "value": "425ac4745b423dc3c1464ac544fff826a871d8b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231466, "uuid": "63c4500d-f9fe-4e8d-8a2f-c643718f09ac", "comment": "Malware payload (Mirai)", "value": "c4efc8e5f77347c80570db3e60aa5eea87520ea684d396a4b4573d3b61c098c0a6d20fd9b7772585858c48b769e7a45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231466, "uuid": "a281f1a0-bbc0-4618-8d02-d99f1b046073", "value": "T161233BC4A953D8F4ED1A0D706233F7365BF2F4391138F583E764A937A892701E64A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231466, "uuid": "5434a820-7338-49ec-83c7-3bc3fce4bd12", "value": "768:RslkATSK04G0z0Bxlt20F8MWN4Qy9esfjrPsX2u/uhRRz:RslkATSK5G0z0/JFAN4QoesfP82uGhRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231466, "uuid": "e5d29aad-6555-4321-8f74-51a513a2846a", "value": 45712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231466, "uuid": "5007d79b-1787-4d1f-94c2-2d9e5d845680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231466, "uuid": "41c18de8-17b3-439a-8d6c-6d39621dbed5", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c87c843-e747-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295439, "uuid": "baf0f7fe-c7e1-4bb0-9aa8-f6f22cfcaf2b", "comment": "Malware payload", "value": "9b6104337afbd21fb7bd15de43c042e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295439, "uuid": "889d3314-56f2-4b0f-a7d5-35f0a3db1b3a", "comment": "Malware payload", "value": "314d342ca327479916c8d8c884d4273d2af8e6fa749ccd35d3c79448493d6b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295439, "uuid": "dd275e41-cd83-4116-af07-eacffe7a136a", "comment": "Malware payload", "value": "a36691ed25c943b10f89fc86f5f378d0e5ee8ce0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295439, "uuid": "32e3e067-39e9-44f3-b2f5-6d9e4961b91a", "comment": "Malware payload", "value": "12e68a3222eed0799e0dea07e3ef1f990016b8a455c6df4feaca3b5282ffea55634f7dca0f6c8f488d6d8afedf7c2e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295439, "uuid": "526ce780-05e8-4b9c-bf12-2736a36c4a67", "value": "T177935AD7F801DD7EF80ED77B44574509B631E7A106830F76A357BA63ED721A80A22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295439, "uuid": "b9cbbf30-2f41-4aed-92fb-e480b05ba8d2", "value": "1536:sNGgIXnn8TPb+IKZzZmG+972Xyyjzk5Pt8Fl4t8y00mJ9NwbaY2fydrLkp67Mxi3:sNBqoT+hlZP+972XVnk5P84t1mMP2p6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295439, "uuid": "cfafa00a-112c-4efc-9e22-e45fdcbbd741", "value": 94968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295439, "uuid": "ed6d9edf-e227-4ed3-96b4-2bc80b467e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295439, "uuid": "3d8b7bca-427c-4adc-8e92-0260e0377468", "value": "goon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f57d9-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767279972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279972, "uuid": "22bb5378-de2f-4130-bf99-d4f2ede70cda", "comment": "Malware payload (GCleaner)", "value": "8a6f0af8ea113f7649f410977ef579e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279972, "uuid": "801c2b92-92a1-4eef-afb4-44e67631646b", "comment": "Malware payload (GCleaner)", "value": "32ba83025992f68557d68ca90bdd8306304e4a34e302066139f81e5ce034d2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279972, "uuid": "f1caabdd-b577-4d85-b734-9bc90dcb6d6d", "comment": "Malware payload (GCleaner)", "value": "06e6bd43e768209cea00890292141bf2dfc33bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279972, "uuid": "2b2d8b1f-f907-4d0a-8c58-8340b773ffdd", "comment": "Malware payload (GCleaner)", "value": "e70570b9280cb1bd69271dee257bca2bb0a45ed1b35d7891ff2ef91111e9bb98eb2bb2ed7788e70507153ffe00f71c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279972, "uuid": "5837e4dd-e2f1-4f8b-8d82-ae14024da53e", "value": "T1D436F1C391A03BE4E175A3BEAED11D7243464E3F3919378EA4B89DC89B5B0C12B31597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279972, "uuid": "3d6410a2-f539-4fd2-b5c1-ad1f456a7fb9", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279972, "uuid": "4f754544-0eea-424f-b29c-7f047c93d880", "value": "98304:L4nCVTMB0EuS47XGH7k3p1yAcOtpFH1KLDS1upENey+UOu/2QJ:8ku0l1X4k5nTFH1KLDS1upENey+UOu//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279972, "uuid": "18475050-6b4c-49aa-949d-9ff4588b0dfc", "value": 5180688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279972, "uuid": "e3756a88-4dfd-43c9-98fd-8296071ddbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279972, "uuid": "89faa73c-8d04-4548-a46e-d8422719e188", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b334e511-e714-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273654, "uuid": "eb669e6b-100b-4c32-a42d-948a86b6a012", "comment": "Malware payload", "value": "21885ee7fc61f700e8794b44c0294902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273654, "uuid": "2daa4fd3-0d72-4a42-801a-9b4e13a4ad94", "comment": "Malware payload", "value": "333aea14924625a820a5445ba0d217cd13a4a18872d0772a991c4eea3f903db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273654, "uuid": "a06db6ef-53ea-4346-93b0-ca1ee8c08259", "comment": "Malware payload", "value": "051fa0961d5280cae9ca00971d3bfedd40b82d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273654, "uuid": "0e996ef2-b064-4181-9ec2-833db2d72fcc", "comment": "Malware payload", "value": "cd402be36dd246442e4b1acbfee79c67fc9f19d1f6bdd412daf7df3d5e6ea28050352479435d398c7c64e3b2615862e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273654, "uuid": "f2b04e3f-9725-482a-8a5e-661772a8b2b4", "value": "T1A2A61344DD90DD32FBFB063662B98D9CB36160B445ACAED99551E0E833CB38BA34C5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273654, "uuid": "ede4f996-3e66-4fdd-80af-9ee25ee92448", "value": "196608:kzyhvkReuduBGvlmNZ9lb+K+vaqD26JXhpYm:kGueJQNmNZ9lb+5vaWL5hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273654, "uuid": "0d9562ba-bebf-423d-aa4e-88e81529f759", "value": 9586656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273654, "uuid": "ca9960c9-0078-43ab-a509-39e4a7e24cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273654, "uuid": "1b6a6aa5-31b6-4e53-a2fa-90ece04f9ea4", "value": "recoil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ed3675-e722-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767279636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279636, "uuid": "0255a5ef-9256-491d-9054-6262525c5025", "comment": "Malware payload (SalatStealer)", "value": "e72d6f928717f94b694a3675f04746ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279636, "uuid": "261c7091-a586-4c56-a69c-edb0dd429f11", "comment": "Malware payload (SalatStealer)", "value": "33a369654917f0fef6b1915415402ed0fe34f0f7b0e5b43498cff80dd0cd11b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279636, "uuid": "3c7d2f5f-33e2-4036-9b98-60a3489c13c0", "comment": "Malware payload (SalatStealer)", "value": "55b37abe2b53720f6250059c414aeb9581fdb688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279636, "uuid": "a332f366-ca52-466d-a5fe-70f86bf3a190", "comment": "Malware payload (SalatStealer)", "value": "0856d67d95ce5b589f6711d36895143385b8326a081cb756d54c505e53660bcc8ba297ef888f9088cc416b48a8c8e8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279636, "uuid": "1d8d5067-37a6-4d63-a6e8-a0c1f161ba87", "value": "T1D2E533BAC764B685C689F5347139960372C1BB95D2160FF49C3A3C2EE2E0539EF69630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279636, "uuid": "cdd92c1a-f9fb-4bb5-97d5-9c0f68f459ec", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279636, "uuid": "482115b1-5215-4c2a-8b83-f46baf6d2f32", "value": "98304:u/n5boNR0+bFGSMZ+0zV5JMFvGYs45m80DzYz5C5v:I5sH0qFGJ7VEFvGYb5m8qR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279636, "uuid": "dea305ac-68f1-430b-9138-dccbe3621394", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279636, "uuid": "90500433-eec7-422a-ae6a-28abbbd5e432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279636, "uuid": "e98c95e7-ef44-491d-a8b2-6f640209657a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294ff4b1-e746-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294897, "uuid": "a86cd409-1ced-425e-a332-9e4baab4d7cd", "comment": "Malware payload (Mirai)", "value": "5bbd805f5254937d1fedfb0ad155ee44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294897, "uuid": "d60d8798-0d89-4784-b21d-635abb858423", "comment": "Malware payload (Mirai)", "value": "344bf6641f112d9ad20b21d0199f70e355a019843cda4038e651ce34be11ff46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294897, "uuid": "bfa3d14d-1317-4b4a-ab26-24ecf064aa30", "comment": "Malware payload (Mirai)", "value": "5508b3fed141b5fd02b14f702a53d8c7532792fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294897, "uuid": "bf8663a6-8a5e-46cf-8c25-3b1ab4c32779", "comment": "Malware payload (Mirai)", "value": "69d4445b2a6e89c96a456c7270900844ca775ba81ba148fefb632e3f2c0154265760d9b8bfac32d4e632f9e1b65ba22b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294897, "uuid": "6d89a5d0-65cd-4fb0-912e-3c7c2d8fac2b", "value": "T18E7312B231A6DDA2D2A2443263877E4DB9238879037453BEBC7DA36FE482D115C0C49F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294897, "uuid": "9216e7d4-7e5e-455b-b933-a024a5802be3", "value": "1536:n8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmCdorO:8zRnwP0bMQ2RijvDZZ1rYGhG13mSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294897, "uuid": "15124513-df6b-4a57-a508-b5bac0899d33", "value": 74772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294897, "uuid": "185c7ce4-52bf-4828-a76c-8ba0d27ecb5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294897, "uuid": "5aba56bc-6c08-4480-b3f4-8fc652afe4cb", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d222b7b-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227177, "uuid": "d9277ab7-d501-4d6e-be7b-9fd2d51ef18c", "comment": "Malware payload (Mirai)", "value": "54e6dff0ce0e4e1ae4860c1ed8fc07b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227177, "uuid": "091b30d9-d9b2-40ee-8ef3-7d02a3358447", "comment": "Malware payload (Mirai)", "value": "34c305011df57fadd24890afa5346dc160d9cb44386380ffba8832c532e2914c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227177, "uuid": "e9156309-c55c-4a82-8ba0-b004db2c4a84", "comment": "Malware payload (Mirai)", "value": "5381d45cf909e335576be6fcf696cab3218eb494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227177, "uuid": "984428eb-1008-4130-a3e3-a733b7695f4b", "comment": "Malware payload (Mirai)", "value": "90f7dd08294f881dc92219285271b57a78b38b3604714c25de6937eea8a5ae6fc0b97d9f270a2efcac231421172fad91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227177, "uuid": "dad6a07e-83ed-4849-8657-6a5d7cff8622", "value": "T1A6534A217A796D1BC4C8B87E21F78234B1B1174A32B8CB2A7E720E5EFF1055461179F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227177, "uuid": "c1cb93e1-80ca-4684-ae2f-df8d88582e24", "value": "1536:HpcSTDaKFCQhk2il6Djv3uad9xcCOlXe8chG:JZtoQ2O4ZXe8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227177, "uuid": "bfb6ddf9-a386-4373-8e51-31ce2a5aad00", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227177, "uuid": "764d3c29-8acb-4e59-a079-3caf51ac83cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227177, "uuid": "1577a339-a2a6-42e2-b84f-60ceea31f43a", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91033eb-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767226097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226097, "uuid": "b5cb43a6-43d4-4bf1-b76c-6304952ac942", "comment": "Malware payload", "value": "cab6a11976662ab256d58a93f0414dbf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226097, "uuid": "a01ceaf2-9e15-4853-99bf-3287cfcdd6a8", "comment": "Malware payload", "value": "34cc7805208b03a40b4698b01d15e624681f8bf3e0e8b9e496ddedd6259fe74e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226097, "uuid": "391c15ff-c80c-4964-be0f-4434fd3d018f", "comment": "Malware payload", "value": "b10c46e4fe5cdf6c105347534d28290d183f734f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226097, "uuid": "8d931ec4-66d0-4c55-8a50-77327a05c415", "comment": "Malware payload", "value": "9b820af774b69f458c637018e23195a18d57d128bc3071e66cee524055469d7bb1f7b2013020f9604417604f724b13b9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226097, "uuid": "8f40fe3d-3184-4dab-aaa0-9a26583a2140", "value": "T11B3210BDC9E0FCC0475B32D1B8AAFAC2019BCA03AE5B1B1CF9DC08615751665EF79488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226097, "uuid": "4c6ff92c-87b3-444c-b4e5-d7a55bcca561", "value": "192:+Y6C91u+eRv2I9KbvBjOSUdJR+pms5KcjJ4+MYh9iGFmL3i3AVyfkzbUX8YTgelE:+HCru+uN9K7BjO/ju1/J4+MYhxFYi3Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226097, "uuid": "7dec4b11-19f7-4c63-b822-ed96c4c585d6", "value": 11442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226097, "uuid": "a0b25de3-796a-4558-af53-905ec4ce1f76", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226097, "uuid": "ebe10288-f28a-41df-9ddf-71b70db5175b", "value": "prueba.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ee40b2-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272094, "uuid": "b1606c9a-f191-49ff-81e0-9e20cc059314", "comment": "Malware payload (Mirai)", "value": "bab7cd26d1b039e2a8c7b836d951bfab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272094, "uuid": "21d0a4f8-9336-4664-b57e-b8b21eccc8a2", "comment": "Malware payload (Mirai)", "value": "34d4956bc381786a0913e05be716bdbad46d7cfaa2de300a6e853c3cd2e44be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272094, "uuid": "5548a499-7cbd-40c0-99c5-fab9e00fd231", "comment": "Malware payload (Mirai)", "value": "8f50b08f7642fa402ea4519abe49e368acce1cad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272094, "uuid": "00a8e41e-732e-4b2c-b34e-0675970f339d", "comment": "Malware payload (Mirai)", "value": "e5cc4fb6a814efabbab61a2febd1502927b02d33d3e9c466b9cef213f84fe4dc814cdd0aef589f6d12dc7c82b7ab3908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272094, "uuid": "56c50180-3aca-459f-be4c-47aed9986864", "value": "T18E7302BFA0F1CE8DFC1A0B3088DAE7684656351151C56E31AD2D34CABADD70421F8EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272094, "uuid": "18fbf807-4069-4ed1-ae7a-328d5bb0b1cc", "value": "1536:hGmdImBbqVIFqRHO8OHBs7Dtfrsa0ToYYDz9C+xbOR8enlR1CWEnDAHUL1XuteM:cmNbUxuJsFfQaIoYYDZxbOR1z1CXZBXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272094, "uuid": "128b3153-4cb7-4c22-9b7d-73cd0cf73623", "value": 74812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272094, "uuid": "8115f557-04a1-4549-a53c-32ba9ae0e4d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272094, "uuid": "f3685807-e898-4ba5-9960-13270dad71a0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6441ab48-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229283, "uuid": "93b07692-7280-4ba5-9051-c503b1b8a701", "comment": "Malware payload (Mirai)", "value": "daa43e05cde4964632a8812bc135f42f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229283, "uuid": "b9732670-a673-4d49-b74b-678ad5150b9c", "comment": "Malware payload (Mirai)", "value": "34e38126bc565348e18a1d04b8295b83f6d98d27662e0b8afbefd9cddee1d587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229283, "uuid": "d713b550-4682-44bb-971f-eba0a4ab4385", "comment": "Malware payload (Mirai)", "value": "7805b88c3a40cde55b5575ec096c7558e4d49742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229283, "uuid": "c1be9b86-cf97-4ba4-9463-9fd8712f42c6", "comment": "Malware payload (Mirai)", "value": "0ea5e4cedb37964beeaf58bafc75c55a0493e2431ed0efd95466f6dd1dc95536af30153d9896c9763b5b82429d7e53a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229283, "uuid": "6f82919c-a930-42b7-9ddc-854dd0056ec4", "value": "T13A633B46EA87F9F0CD450AB8205BAF75C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229283, "uuid": "1d141242-c800-4e29-94df-433b2239c53e", "value": "1536:IeAolofbYYQsBehM1XcB3xESOUd3dgo8SbmDOm3:IeyssLcBTjXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229283, "uuid": "7d1e9939-eb3a-4342-80d9-e6f700a1ef7b", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229283, "uuid": "a9aecb70-c5d1-44c8-bb25-755290d9960e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229283, "uuid": "4ac158ba-664b-4b92-965e-040d793379b1", "value": "KKveTTgaAAsecNNaaaa.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b4f8e8-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767297797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297797, "uuid": "0460379f-121c-431f-91da-f21114fb41d9", "comment": "Malware payload (Mirai)", "value": "4321fc92aafc6df5d7ff5c11f8bf2292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297797, "uuid": "ecb24f28-3a2a-447e-9a8c-6a5475066457", "comment": "Malware payload (Mirai)", "value": "359f08e58f2ed0d8abdcb5b062af65f89dad3cc1251e30f4f90beb895fd0fb18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297797, "uuid": "42f4416a-4b24-4444-8c9e-666fb24d9794", "comment": "Malware payload (Mirai)", "value": "c1f0b2c08425ead86e7b667093f9a4d7c7cdd892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297797, "uuid": "de176359-c29b-45b4-97a9-f12e6f8523bc", "comment": "Malware payload (Mirai)", "value": "0418974634d8b1eb740a727d5fe19d9d018484273c6d128dda83a673516e99bc98a25e622b2d04c991a6b3ddc07acf8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297797, "uuid": "d10f87eb-90ff-4d3a-a8b0-288ab73b168a", "value": "T112056C1BB2E3B4BCD457D43043ABCAA3A935B43502216E7B65C4D6313E2BE70171AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297797, "uuid": "2d88c043-0b79-4f58-9ff1-476ce632f21d", "value": "12288:2VvO9CKfUo4smXD/zkmrerzoBQxv12uvw6UvM3G/jHkl7tjc+dzuF0gt+JywFErp:2QUc4sEkmSHx92uY624l7tlNEr7PUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297797, "uuid": "5e39c603-4347-44cb-b2f6-aa5bbfec7647", "value": 835920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297797, "uuid": "8a81353c-eb66-417d-acb2-7d0c4c39db42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297797, "uuid": "dc1271a4-c835-4119-a4d4-cdf6691f9cb0", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29b83f9-e734-11f0-a129-42010a9c0007", "comment": "Malware payload (BlackSuit)", "timestamp": 1767287477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287477, "uuid": "0ae72f7d-e43c-45f8-a044-11f4314ebd4e", "comment": "Malware payload (BlackSuit)", "value": "87d5fbaa3cd647071c51df0e07443c6f", "object_relation": "md5", "Tag": [ { "name": "blacksuit", "colour": "#E2206D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287477, "uuid": "f220c729-6a63-4152-99cd-1dcd2ac1e47d", "comment": "Malware payload (BlackSuit)", "value": "35f3ee553626b2267e4a8f35dce5b40840e5a461f13652bd2659681c31068805", "object_relation": "sha256", "Tag": [ { "name": "blacksuit", "colour": "#E2206D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287477, "uuid": "bcf9a681-db97-4126-876b-e7639267d27e", "comment": "Malware payload (BlackSuit)", "value": "edee2c23114158fce48124a01db9c53f7a228a79", "object_relation": "sha1", "Tag": [ { "name": "blacksuit", "colour": "#E2206D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287477, "uuid": "a7d36b9e-389a-492b-941e-9ecfc7e8f2bd", "comment": "Malware payload (BlackSuit)", "value": "396ead9652449827014a30b2b2ebafdf7050b6954f4ce4082f65df86492247dcfe5d920afb0845a2cba96c1e20b43f95", "object_relation": "sha3-384", "Tag": [ { "name": "blacksuit", "colour": "#E2206D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287477, "uuid": "afe0fdf3-885e-43d2-9c5f-a4cbceee305f", "value": "T188472310EB605029F8FB22F756FD956D992CEEF0275450CF42C565ED8A2A6E03E3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287477, "uuid": "15785a1e-c0bb-4f25-99e1-bf0becb988b8", "value": "fb7fef127dba18844de1273f7bed056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287477, "uuid": "cdcc72aa-6b65-4dd2-9e74-ce14fef545e6", "value": "393216:rIG6qcMK405dsuJTGHmVN+nO0NrN1IG6+ckj405dsOJTGHmVNwffnG0NrN:rlcMK40IsUO0lnlAkj40IM0/G0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287477, "uuid": "9861404b-327a-4d65-9dde-bea32edb98a9", "value": 26836992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287477, "uuid": "c070f2a7-70a6-4db1-962d-856144e8c001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287477, "uuid": "fb6f239b-03c9-423a-b9b0-97ea6aa92b55", "value": "oledlg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edce7fb9-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1767226078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226078, "uuid": "0e9b906f-8481-411f-a8a3-553db091cf1b", "comment": "Malware payload (RemcosRAT)", "value": "22b7cbacaf4824a7d616a68aaff87c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226078, "uuid": "c5e6f588-3091-4767-aa98-3d6514263bec", "comment": "Malware payload (RemcosRAT)", "value": "3665b2d3592015cc53cb7e5af79cdec345c21a85d9d07968d6c7598128ca5cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226078, "uuid": "03a6a25b-ee83-4a21-8ceb-85ab05463ca3", "comment": "Malware payload (RemcosRAT)", "value": "a8a7f850b858621c0ecc3740d0190ee5b62c3de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226078, "uuid": "6a8b60f8-54c5-4252-9a8c-f47362e1c3bf", "comment": "Malware payload (RemcosRAT)", "value": "12f3d064adf1752d85e2a5a1a17b90b3e1244d5eef00df4a9eb0440bb6bf018d9b6fdcf57f352fde9974b50cd54aeed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226078, "uuid": "5093be06-6082-41c6-a877-aba6cdf2a606", "value": "T1B9B4B001B6D2C1B2D57254300E3AB725DEBDB9242836897BB3F60966ED701909739FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226078, "uuid": "2ebfec8a-5586-4667-b4b0-2825fc6bacd3", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226078, "uuid": "eb8abdd4-c819-4d02-989a-1e76caeafa79", "value": "12288:f6pxxGI8gvGOHJpAbDYGxLhZ+sPZtOmPFN:f6pxxx8U+bDYGxLhZtZfPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226078, "uuid": "2254eb32-1a1c-49f9-9c87-611cd3443208", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226078, "uuid": "c87ee98a-7d4f-4b70-9200-c1f0ba4f6879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226078, "uuid": "f6b63367-2781-4f85-bbf7-c90e02370f15", "value": "Herramienta de eliminacion de malware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750e5bca-e6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767258517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258517, "uuid": "ce201875-753e-4d2c-9593-4f29babcd2ad", "comment": "Malware payload (Mirai)", "value": "aa9568d03ec80591645f59edc59bc140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258517, "uuid": "4eb173df-7e5d-409f-8b73-e45bd6e3675f", "comment": "Malware payload (Mirai)", "value": "36e457a9bf59da702c490e967aa4d1393dfac14d895116e260bfae99ac4a5267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258517, "uuid": "9ba937a8-0904-43da-99a2-98f815407b93", "comment": "Malware payload (Mirai)", "value": "a1bc49bfc176c2e24ff8915d259cc6fc8803e920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258517, "uuid": "610a9c03-e83f-4dde-96e3-0deaf28d2f83", "comment": "Malware payload (Mirai)", "value": "2ab1ec3357a8da73aa1bb63a70e221ae4b358108bb296f992430846526e09fbd50b3c908a4b371b4d16fcdf0541afcbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258517, "uuid": "e2d55fa6-e6c7-4057-840b-14e07b39687c", "value": "T10BE2F020C6893C80FAF79DB0F9C2F2C6FFA167ED15F1ADA146859360291ACD39715B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258517, "uuid": "8808dc16-37e7-450a-a642-972857641a48", "value": "768:otkxJiMnRGyEIIHcDt77va6bUVEvoXBIjGLz25OB4uVcqgw09N:fiMsRIIHcDt/vnYVDRiYB4u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767258517, "uuid": "e0e5c7e9-dd8c-44c8-bd50-2ef6dce3db07", "value": 34124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767258517, "uuid": "935ac71a-eae3-4c4f-aff9-e5be44e74705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258517, "uuid": "1f20ca98-e216-4d19-8882-a48c4c91354a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831d4986-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292041, "uuid": "2a62f81e-959a-4723-8aa0-8838cfbd02fe", "comment": "Malware payload (Mirai)", "value": "47ea40e89a47523a772b540410e362e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292041, "uuid": "c021071b-4c55-49cf-ac29-9ff063820875", "comment": "Malware payload (Mirai)", "value": "3722aafdbac03a92578a4186ea7cd18ac2943e939be9bf7f248c14d8fc8b3c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292041, "uuid": "032279cc-9b45-4686-842e-d6d93ae92e83", "comment": "Malware payload (Mirai)", "value": "a2e906896c6797a4d46d21783b20619bb0695c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292041, "uuid": "827126e2-5935-4a79-bc2d-4c375e0c0a1c", "comment": "Malware payload (Mirai)", "value": "68b2c8ab7b27b0d67c5586899bf20bf31d863725aa31efba412c28dd2e874174970ebef575eb5e88a0a7f9ba2d19c814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292041, "uuid": "87ca1e30-21d3-4a4d-ab39-1d44aa07ca59", "value": "T154045C41F687C0FACC57487050A7F73FCB32A82A5073D69EEF995F31CA27A0156162A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292041, "uuid": "ce4313f2-b34e-4c80-81c9-99ae80c0bd70", "value": "3072:y5/wYCUcjEkvAdSyFwyk7C2yir5/E1/sehsUFR6sS/TpUFhIB16v:nYCUcwkvAkyFwyk7CR5FvsmmTp4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292041, "uuid": "dba6c1b1-00f2-4b3f-bcb4-8f6e34ce7f09", "value": 178884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292041, "uuid": "c674f62e-8c7a-4cdc-9ed7-5bf8dd1632a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292041, "uuid": "4ddf3250-7d48-4330-89ff-38a0042f2fa7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51e73b6-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292555, "uuid": "637bf04b-bf7c-445b-ac5f-faf52dbcd082", "comment": "Malware payload (Mirai)", "value": "f43c9c97dbb59508862668b876c5714f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292555, "uuid": "8e892bbd-0d90-4793-9c90-937480b436a0", "comment": "Malware payload (Mirai)", "value": "3735cfbf66d05d78bec77ce82b72f5da76edba554c8db173d9111f5a7b4dc96a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292555, "uuid": "2cc2bf6c-0962-4921-b5f0-aa9a4df3fc23", "comment": "Malware payload (Mirai)", "value": "d1e9fe85ae948806be6155e4747ac8a655e544ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292555, "uuid": "149e7e57-cab7-4f04-a9a6-610f169c488d", "comment": "Malware payload (Mirai)", "value": "528c8bc9501ba6d92c379d6d61a4bcb57bbea95d937dc8e70b33fb7bd7eb7509ce8d3ac0a0af92b1a1fb23205eee07fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292555, "uuid": "0d76fda3-19f5-4d91-8249-885a26dd132a", "value": "T15334E99A7A619F7DF368873487F34F30D75563D217E2DA80E16CE5045E2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292555, "uuid": "6a3c162b-f62e-4062-bd14-440d4d7396d0", "value": "3072:Wf6k0S2GxmouARwHM4hy0PMaQwv8igQyaHWajhik55OyiTsE3oDlBjMfI2Bwrbbp:1+xmBjH8xa2aBOySjulB2zB4bPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292555, "uuid": "529c8e75-cfe8-4e33-a23e-4408c0d4c3d0", "value": 240724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292555, "uuid": "73de7ac2-2eeb-44e8-ada4-7865353bed8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292555, "uuid": "cda2940e-d8f8-4f20-b43f-2b8d3ee9ed1d", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776dbd88-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225879, "uuid": "6cc94d30-6054-454c-9b99-4c650ba58ba9", "comment": "Malware payload (Mirai)", "value": "52afec341442f06287515965cd4c1a63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225879, "uuid": "83389da9-b4db-485f-8670-97423dbc3df0", "comment": "Malware payload (Mirai)", "value": "387a38969c04f088814258f19538ae5be050bfd6bf8f64a01f40551e4617c26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225879, "uuid": "2bf1be1c-779a-458b-804f-e46d86105344", "comment": "Malware payload (Mirai)", "value": "c8eb0c6eab9281a1f47aba24aa7c97bfe27d4930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225879, "uuid": "bf5283d9-dd9d-4432-9ddc-cfdb5fc1204d", "comment": "Malware payload (Mirai)", "value": "0873e85ff263a5543f3924db0b2892b4a0318dbafa2032cc8b80e9b5e1e0aeedd397ef04a0af9c32b90d253e0a8bbf09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225879, "uuid": "3c045e4f-4787-4216-884c-4c405a0380b4", "value": "T1D8D3173276301D1BC8DC933A61F78320F672376A61A8871ABE931E9D6F39394B517360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225879, "uuid": "d4f35309-d231-46c0-80e9-4e374251ded9", "value": "1536:U8W7GGU52HOWvKJjYXZYZ19iG22cu99ViAjWJdNZ46jjxFfdkw1uA0H2kTsNvUrb:Ux7GGU5I3v2cQhCv46jjDfx1fsCvUrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225879, "uuid": "ba922c58-13b3-4750-ae53-5c4e79314c54", "value": 140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225879, "uuid": "f9b6818c-5d71-4eab-80b1-50637e94b194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225879, "uuid": "bedea626-cf32-4e09-bd43-4928674461f7", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd585af-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292406, "uuid": "c5101c44-553b-473b-bdee-ac32139d9585", "comment": "Malware payload (Mirai)", "value": "f569a3cd126c6085a958e56945d15219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292406, "uuid": "b7935d5c-c4d9-41d7-bd56-2643604faac5", "comment": "Malware payload (Mirai)", "value": "3950c008673a9cbcc6b2c8813858bc8d9f4c47af5c752a1a85f69fc9e634c4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292406, "uuid": "e9bab3c8-c603-42b5-bef7-bdfc71c024ae", "comment": "Malware payload (Mirai)", "value": "09e5bd4874be1e4748d5206205588ef84da595a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292406, "uuid": "91f0af59-81d9-426c-a1f7-eeb5b23f817d", "comment": "Malware payload (Mirai)", "value": "6d35290773bdec4ee91413b3d242547a3953106d52d9c9b8b92389a15410ee23d046c0fe6c53890f57bfa4c312391c74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292406, "uuid": "27ded430-4f6a-4a6c-a6e0-0efdc4aa5f17", "value": "T115F37DC5E683D0F6ED1206B12076BB365A73D53E512FEA82D3BD9932EC01641C61B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292406, "uuid": "55a10335-dd39-4e4c-b8b1-23cacdd91df2", "value": "3072:pGrAc9OZcoRHzX+n6Dmx7bLFF6p8EX3rhTlI91/Pb70hGB1BW:qhclpzGxu31+fHb7PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292406, "uuid": "1ee8a85e-940a-44ac-8896-16ced4a05c6e", "value": 171876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292406, "uuid": "bffcc8a0-44b1-4cfb-9147-246895ad15a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292406, "uuid": "227b28fd-ba08-4bd9-b005-f1bd00bfc283", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6204a655-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229279, "uuid": "d4c0bbe1-b071-4885-a082-31d22be7cabc", "comment": "Malware payload (Mirai)", "value": "9ceaa3f9adc95e06f2cc7c8d9d815983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229279, "uuid": "92b397f0-5264-40cb-b565-f54f73ad0fa6", "comment": "Malware payload (Mirai)", "value": "3998859d7fb934a61909c72846daf5e775c30189a1d9a9794ee4332c9c4682d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229279, "uuid": "f58ffa4c-087f-4627-b250-b0fb19a5f8ed", "comment": "Malware payload (Mirai)", "value": "f7685c8a958ae97aef4864864eb5ae83e3a4f293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229279, "uuid": "657d0d35-3916-4c3b-b05e-d0306398dc35", "comment": "Malware payload (Mirai)", "value": "3a792fdbe492603a54cab4ff5b77098e75a820443a549ac3adab3562685347b9821bb78ef6ae470af269ca2010c942f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229279, "uuid": "ebb2ecf8-342c-4219-a1a0-c9467cb4650f", "value": "T10093504E6E714F7DFFAD823897B79E209309339616A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229279, "uuid": "45bc5238-d085-4e03-9820-3e33d1eea9c1", "value": "1536:/UNyqwipEXzKt4kKSdkVz+lW8QYExjSk7IB6WBkunXs9fpQEH8o:cmkKSdG+lW8QYExjLMnBkunXs9fprHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229279, "uuid": "e984a721-80c7-412c-b81b-12c9375348ae", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229279, "uuid": "0a71bda8-62fa-4c90-aa90-5b8c3174251d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229279, "uuid": "36c0ff36-7cb1-4023-a826-a9d894a56889", "value": "KKveTTgaAAsecNNaaaa.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5102f2-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252813, "uuid": "3edfc59a-1e77-4611-8440-368acf0a024e", "comment": "Malware payload (SalatStealer)", "value": "0b0cc2cca8661ff91c0cb11259c5d064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252813, "uuid": "200c6697-7ba9-489e-8303-7205072cf06d", "comment": "Malware payload (SalatStealer)", "value": "39ea7f2301824b4acd0b417751946bf16480e5069436e106c5f2f35428ebe08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252813, "uuid": "a422f131-fb4b-4afb-918a-996da16c3f17", "comment": "Malware payload (SalatStealer)", "value": "4e0d3ce604003230249abefaa34d9c870862453e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252813, "uuid": "7166a7c0-f46b-4a12-a646-b185ee309cc0", "comment": "Malware payload (SalatStealer)", "value": "5ad9f888dcccdac160a4806a86d9baadda26b33f4c5328d2b7d008f9239c6e7438e4b19cfcbdbb9c0a0fedc1a403a398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252813, "uuid": "a03c0b71-56f6-4beb-be8a-b4387552dbac", "value": "T120C65B51FA8B54F6E9071831805BB23F63305E048B28DBDBFB547B6EFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252813, "uuid": "1b92f983-d14d-4f2e-9432-3cddabfd0952", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252813, "uuid": "b2149fcc-4f3c-4f9f-9894-a1577d59a40e", "value": "49152:rY8+paD6Mq5TFHUzlctKaNCvYUQEXJ1xl8oe9Md+9r5ZBdNKpZKfnwmLbhq1UHy5:ktp82EcBX4DUydpEWULBiebZAJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252813, "uuid": "906cc24f-b030-4e8d-a648-b8f9e8737ca3", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252813, "uuid": "8913db50-d0bf-4f51-9b3c-c84f5930dfbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252813, "uuid": "b3f574f2-ad8e-4fa8-91ea-231b3297d340", "value": "11f829c6184e759264b2228ca9f8ef5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6088b88a-e6af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767230136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230136, "uuid": "44f6f22d-9511-4769-a1e9-2cf1d6db1f74", "comment": "Malware payload (Mirai)", "value": "76b502ea7441d3b58ed6bb146d77699c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230136, "uuid": "d02658a8-fb07-4452-8667-611f6007bac3", "comment": "Malware payload (Mirai)", "value": "3a1f076ac47044594676a4cf7c7f548265aa8b499a3a6066836546c6ebb315cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230136, "uuid": "b90f0554-37bf-4f6b-b501-c359a1b5eb03", "comment": "Malware payload (Mirai)", "value": "efcdbdcda92a65adcc93921ef865acede8dbef31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230136, "uuid": "1baae8ce-2efb-4fa3-935e-4232565bee88", "comment": "Malware payload (Mirai)", "value": "cb455a55d190dbad24603eab261f443b08046e97e0d249d057fd0a580fb7091bd53dc218460de91c81ac3c14bee50517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230136, "uuid": "abab8f3c-867f-4685-aa7f-924120fd2a65", "value": "T111142946ED418F11D5D622FAFA9F018C33536BB9E2FA7102DE205F6023CA99F0B76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230136, "uuid": "9e3cbb5d-7c86-4d77-8958-0d82ba7a7b46", "value": "3072:kvlVe2URtgnA04MwREHKVAbW58fyitSfKNwODuxEHK1g0vkz/lk59nlqyVnyanxN:kvlVedtgA04MwREHKVAbW58fyeSfKNwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230136, "uuid": "96bc8921-3427-4670-9ce9-0888e10a9261", "value": 195236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230136, "uuid": "872964e9-3f3c-4aa8-9077-2a3070ca89f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230136, "uuid": "ed1e92de-bcea-4a24-a671-17ba0b313ffa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3e147e-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292912, "uuid": "78a6a97f-6339-40c5-af94-f50ffcd92250", "comment": "Malware payload (Mirai)", "value": "4ed5c76ed283580b8e4401314aa62c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292912, "uuid": "9dceb0ea-3e3f-4658-8a8c-a21c90c9425c", "comment": "Malware payload (Mirai)", "value": "3a9b5b6ffae29684358bd2b25268de77f64f0f90d96fd2b4e16442ebe3b65b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292912, "uuid": "5eb7b7b1-1fa1-4053-bfac-6d7ae1bb8b07", "comment": "Malware payload (Mirai)", "value": "0e9539a021d8e6defadb3ea8bccdb80c67436e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292912, "uuid": "e4fc8d53-6600-4c56-afa4-c1770c320ec3", "comment": "Malware payload (Mirai)", "value": "460e5287f454bb281c7e41b94140e66ba3113ce429cbd929bc1fef484215fe660c897761ef428732d95b4c86c0dd7342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292912, "uuid": "b821153b-2e14-4599-b063-e9909fd64ebf", "value": "T15814AEA3B70B28C1C82106F417CB9B9D6E2315139D67D6E3BC6E363A6E764CE15123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292912, "uuid": "30be9efc-ac6b-4c72-92cb-9887a735c92f", "value": "3072:3U2DFmSsTo/T9JTNNbPoU6JZsWuILEDsHQ08OgrCt7PpgzBub01ELqrWe:k2xQ6JjF63uILKel8TCt7PpvLqrWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292912, "uuid": "b1c6fc52-3f68-4b20-bc17-6dd10762ad92", "value": 198568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292912, "uuid": "49bec2d5-a51d-4f69-86db-2af768880b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292912, "uuid": "504fe76b-6367-488a-ba6f-1f7c70579790", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28e5f58-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228153, "uuid": "c5c611bd-345f-4809-bf8a-07358202ad81", "comment": "Malware payload (Mirai)", "value": "104b2121465455f7109903d3a6b5051c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228153, "uuid": "7ac03c23-c2e0-4a57-9beb-c912f7860ced", "comment": "Malware payload (Mirai)", "value": "3bac8932e40b9738302775c07ee212c00eeb46d550afe706f496fd155a8de318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228153, "uuid": "6527cb93-942c-4dae-8c58-6a4cd076fa84", "comment": "Malware payload (Mirai)", "value": "cc25ba1d730ced56804e000fd5e4c02334196748", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228153, "uuid": "783c86af-0870-4ebf-81e8-7ed9308c0f7b", "comment": "Malware payload (Mirai)", "value": "45292b508be1b007b3ab7f25aaaf0dcaa023de670fb97be441b26c46cd261cc5071c390cfa4ba35b29a30d1bbc0fe7af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228153, "uuid": "24e7fab1-42a9-40ef-b259-88752b4f891f", "value": "T1E9143B42FD518F13C6C622F6FBAE018D37166BAAD1EA7103DD20AF61378659B0D37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228153, "uuid": "a7393d3d-2e68-4b33-b83a-4b920eb0bed4", "value": "3072:YtQ8xkrRjHRy9PDyJn5lsmCWxwHH4QBXlOvY+hYu6hh1LBeH:YtQ8xkJHgl85Djmn4AlwYAYhBeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228153, "uuid": "9c871b0a-799a-423c-910c-e2bbb9c28177", "value": 209000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228153, "uuid": "843c8e60-dcfc-47da-919b-bbae32517551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228153, "uuid": "24d08569-b1dd-4faa-a6ba-f5224e717d50", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28917e12-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767227035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227035, "uuid": "8b11eeb2-6013-4782-ae5d-9fa8aa7c2bd0", "comment": "Malware payload", "value": "497838dc8b2eeb9883b2469a29de4d8f", "object_relation": "md5", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227035, "uuid": "63816760-a5fb-47c8-a327-09e588299913", "comment": "Malware payload", "value": "3c666946206e17204b1c7c65e758b40d1317075b523505db88056786c8b44554", "object_relation": "sha256", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227035, "uuid": "d643e63c-47b6-45a0-9b16-7a920a98e77e", "comment": "Malware payload", "value": "79a111822fec5bbbad40097c164debab21dd6f5b", "object_relation": "sha1", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227035, "uuid": "4e39cee0-bea8-4b36-975c-6bc05ffba5a5", "comment": "Malware payload", "value": "551398c89018a6d1334e4a2c06d6fe62168eaa959dc76707d91acc0b089a5f7401ffe9f014b1e4972491542df041216f", "object_relation": "sha3-384", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227035, "uuid": "261e0b2d-3388-43c3-abd0-08e0d460c1f6", "value": "T16E958E4AE3A440F8D4A7C17889565A0BFFB1780A137056CF16D08A696F33BE21A7F735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227035, "uuid": "7c3a49c8-3580-4afb-ae68-d6d52f7551d3", "value": "36d285cf4bf32187006804309ac33725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227035, "uuid": "f46820ef-293a-440a-a759-e682f82b50f2", "value": "24576:dr2zd1khJsvPe225fn/OYwjDNYB4Ut5xYqlV9YhZDk8MN/8Q43nwSWie:Uzd1kN5f/ZsNYCqlVCNE/X43wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227035, "uuid": "f1c4f123-3c71-4397-b834-d52343296128", "value": 2053120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227035, "uuid": "604c992f-5826-4ec5-8f94-c62f4ef693b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227035, "uuid": "951d9a53-8fb8-4555-b0f0-2bbfa4c5069d", "value": "Talleuhuongdan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384125f2-e71d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767277313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277313, "uuid": "d93bf0ef-0375-48d4-9a19-f4c2da56680e", "comment": "Malware payload (Mirai)", "value": "73b522f3baf98c1644305360f11c3606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277313, "uuid": "163cac75-1d3d-4980-ad7b-c97ac35fab25", "comment": "Malware payload (Mirai)", "value": "3e3435b9376b474eaffd43d86316c372351209dab70259340c5119cfbedaf01c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277313, "uuid": "ac4430c8-32a1-4f15-bdd4-83f01aa5a557", "comment": "Malware payload (Mirai)", "value": "779172c5bbb9cefd20b623bcfd08e1036950c1b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277313, "uuid": "2daa9f00-136a-4bd4-ba5f-a50430c9af88", "comment": "Malware payload (Mirai)", "value": "fbb93321dd770f95cd30b244bbf443138eb87805ab261f3373f166eb6ba06c35cec84d6024c58ca0f81934f009974c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277313, "uuid": "2747d0f8-52cc-4e98-bf5f-0330a76dfef0", "value": "T1EF34E99A7A519F7DF368877487B34F30D75573D21BE2DA81E16CE4041E2028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277313, "uuid": "786c96a2-8008-4c68-8097-0549d2537f8a", "value": "3072:kTPsnQvWUTy8mUwOCOIHFkgZIZ4U3bPPQyg0NgXiY8Kbco3COQ6XrUEchnBadpcE:ksRUTy876ybngmgE+HZoEchn+Q7/zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277313, "uuid": "2cf7de77-f960-487d-a14f-903a0ef8947d", "value": 245272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277313, "uuid": "fecd4ab4-9e69-433f-ad7d-e4ecccf32805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277313, "uuid": "e69712f2-ac1c-4c62-b517-8c3aa5c0279c", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2feeb657-e6d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767248093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767248093, "uuid": "bb6cf325-6cbb-418b-bc58-74cb5a619160", "comment": "Malware payload", "value": "1e87165043f45114ea6253b23483bdb8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767248093, "uuid": "891be8b9-ec1c-460b-b110-1e33264c6638", "comment": "Malware payload", "value": "3e79a0d9bc013f3374aa8aa1129b1aa53a1bf16aeea1e8c9d06d0d964324feaf", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767248093, "uuid": "91d1078e-3c38-4a40-8d07-e50311dfe1fd", "comment": "Malware payload", "value": "4b591cbf7c469a940e342ccc441c3a77c94f30a0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767248093, "uuid": "54726583-8eb9-4732-8212-01bd21aab46e", "comment": "Malware payload", "value": "a759732a6c8db062b0c72a76e09b04e255d9e3ccf1f5d6426790c358dc940bbf553e7ad14248f6b5d39d22e0af5097a8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767248093, "uuid": "f50cb460-73d9-4ae6-b132-5b43abc6d198", "value": "T1C0E1C686ACF32418740B505DCFBFA6587059A057870ACD9CFECC76A8DF4C2A49622FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767248093, "uuid": "10a5ce73-6e48-473c-a3e4-428f205c3d37", "value": "192:OZBTIE/CTK/e70p0llHYoHsfOBro2Tc/OkSmy:Ol/OnYoHsfO2/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767248093, "uuid": "41271411-c882-4d44-9a34-d67f3b545876", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767248093, "uuid": "e6e0a674-2228-4724-8189-062b93d761d7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767248093, "uuid": "f9aee8b3-a32d-45fe-b14a-86cc2af28f53", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3dfb96-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226988, "uuid": "74b389d4-c9ff-45a5-ad29-777f646c601c", "comment": "Malware payload (Mirai)", "value": "81e15fca84ada196f3f7ce8b6f44d863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226988, "uuid": "4a1e79a4-eb09-4487-ad85-02203d9c37e2", "comment": "Malware payload (Mirai)", "value": "40719e97f803a7e2218d1edc181718f93597ed281bc0556f149a60f5e4511325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226988, "uuid": "bcf43525-0e8a-431d-b13b-e941143ed0f6", "comment": "Malware payload (Mirai)", "value": "97063db9c2cfc0af86220b6d52b65c38f8fff619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226988, "uuid": "5dad8e23-62a6-4d0f-bfa6-32b4d514b353", "comment": "Malware payload (Mirai)", "value": "b85272280c8cf856a445b8b1fe494fd3d661565796542b5dc4b1dc4b5af246e8976b1f09043787ccd865e07235372892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226988, "uuid": "c40282f1-fb0d-40c0-b446-b919b56d0de7", "value": "T1D1534BC9AA43D8F5EC1A05752073F7365731F1352038FA8FDBA4E932B862752B50A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226988, "uuid": "b00fa618-e651-4a58-8858-2d4138b096be", "value": "1536:pGzMEJvj3pjL9wxEWv3zWE69wtJ60WOEaNbSg77XHxLavR:pG4Uvj35h5Wv3zWZwtJ60/pNF7bR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226988, "uuid": "c268f9c8-d5ee-4e5f-b0c9-6e508ba2b4f2", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226988, "uuid": "ff09df36-4572-4c2f-becf-866c0cf2e27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226988, "uuid": "872e9172-3e3e-44cd-8359-40f8b26ea7ba", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83b63c6-e732-11f0-a129-42010a9c0007", "comment": "Malware payload (44CaliberStealer)", "timestamp": 1767286547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286547, "uuid": "b547a032-e573-462f-ac51-2e8e657ced2e", "comment": "Malware payload (44CaliberStealer)", "value": "ac089345d62de1dd397b4b6be9a782b1", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286547, "uuid": "6113e661-6a3e-49eb-8358-908951f4684a", "comment": "Malware payload (44CaliberStealer)", "value": "4123f1345cdba533b2f22b1276b71ceba201e2e26dd49df9850e4ff5d8f05496", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286547, "uuid": "32413241-ca5b-4369-b539-0b911defada7", "comment": "Malware payload (44CaliberStealer)", "value": "f8637b8cf5527f8b1a1857b72c1f54fa6bff2fdf", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286547, "uuid": "cc35044d-06a5-4457-be02-32248c1f5c95", "comment": "Malware payload (44CaliberStealer)", "value": "e5682adf1e62568b31f745fedf43d63e1304bc559706bb29fe7a27a8aee74e24cf24cbb5cb8191bc38de8742937de742", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286547, "uuid": "526b0477-bf53-4e11-aa62-dbb13f511053", "value": "T16464380817F88A65F5BE9BBDC0B551608371B462B83FDB4E1EC560EA2D32350CE49B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286547, "uuid": "d41bf71a-896f-46c2-9f5b-18443b8f0d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286547, "uuid": "9740aba6-4f34-472c-b05f-f09a54bf8ff1", "value": "6144:HRlT6MDdbICydeBV9suqPmlF62wwvmA1D0KhM:HRT4uqPmH6pW1DvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286547, "uuid": "c228ead6-92c9-42ea-a132-cf2f24d85af7", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286547, "uuid": "1bfa5088-378a-49ba-8edd-dbdbf4aa561d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286547, "uuid": "da09add3-b3be-4955-88fc-aef298bec523", "value": "Nursultan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd8d504-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304565, "uuid": "64482608-771d-49e4-9f4e-c196e80ebe95", "comment": "Malware payload", "value": "9ab8035fad13e1c7a371306248d6930c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304565, "uuid": "a7a29600-ef9d-47e4-8c0a-256296edd06e", "comment": "Malware payload", "value": "41558711b8159b4b5d686133941f1c3f62cabb7aefcbb95cfbca48473fbf1ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304565, "uuid": "f334a256-9031-4048-836f-d307732f046a", "comment": "Malware payload", "value": "f7e81b1e8f01a0e0938d552510da6d24bb890af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304565, "uuid": "31b67f38-a322-4ce7-9d60-c5b0ae893aac", "comment": "Malware payload", "value": "da0a0794fc77ea33bd09ceb64a550d1eada87ce0ebdf4584b048a18cb51ef8669e4dabad6e91e3919a137e17435bdd58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304565, "uuid": "25239a9f-ce4f-4330-b259-8bbc461883d2", "value": "T1BD56F951BE822F66C19C037545FD62A667643E454B91033323A8EBEC3E7773C9F5A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304565, "uuid": "5d78425f-0b86-49a0-a388-1b2f6cef1427", "value": "49152:wI5F5svG0SNi7PCHh4MucIhGYPjpCW6NBJ5EX:w4vsv17Puk+PfEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304565, "uuid": "19a3392f-e715-402f-a3bf-521d19bf6645", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304565, "uuid": "5b13fc0b-594e-45a4-a913-b907e4165487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304565, "uuid": "0c60a028-a402-482c-8224-2071c20900fa", "value": "mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e769fabe-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227355, "uuid": "b54529d0-c78e-4cca-a3eb-6185607822ab", "comment": "Malware payload (Mirai)", "value": "108fc7ebe946cb935aeeffe05c7fafe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227355, "uuid": "55cccac7-0f27-4340-bef2-c9dd3c18abbf", "comment": "Malware payload (Mirai)", "value": "41579092e79237420d88478b6da2231f3447e7f68c96d863f95e92b15868cee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227355, "uuid": "1eb1b1bd-8989-4027-bd0d-6849274f8f7a", "comment": "Malware payload (Mirai)", "value": "5349c9dc974e40c93351bbd97c3d9e863d2d2c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227355, "uuid": "ec56aff5-bcd3-4adb-8aa1-14c20bd1a72d", "comment": "Malware payload (Mirai)", "value": "13a06fa55743ed154914a4344c20e74c8691a49f2903cecdc36f99a30ade9fabcec06f64923e4fc6a3b780551b958f8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227355, "uuid": "98b31717-7165-4245-abb6-f59dbd0f1065", "value": "T156032B27F7692A17C0D0127F10FF8B1699591BC42991D66F7E360E6E5EB23002D1AEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227355, "uuid": "f0df501d-6770-4180-82bf-24da5de750c6", "value": "768:gZFsJqBCLtgLpoKhIXZ8SADBbEUsRWuVE6/pOtKGMB4q:gHsJSeUoKhIXqT1cRWGRItfM6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227355, "uuid": "b2f9e87c-b719-4b8a-a9c5-6270684747a0", "value": 40008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227355, "uuid": "dff3d3fa-7d21-40dc-a1f0-f55fa9329a98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227355, "uuid": "bc7709e5-f6d7-41f5-ab37-98b7aa9c1310", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f5107e-e726-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767281206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281206, "uuid": "78bc6f38-9f3d-450f-b4ca-cec9f79ecfe7", "comment": "Malware payload (GCleaner)", "value": "cf08495e70731c36f9727ec18b97d240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281206, "uuid": "34c554a6-34bd-4c29-8b55-dc2d9e9607ce", "comment": "Malware payload (GCleaner)", "value": "416882e0c89da9b827b9d0eee4ad216ff1129bc98d6ecb7d110f3a8510e65830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281206, "uuid": "c78f20f4-83b5-491e-b899-d239b3543a2f", "comment": "Malware payload (GCleaner)", "value": "af307e74f8d358fc1cffe7b11d3f73cd56ad4a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281206, "uuid": "fddbcf03-1c64-4b1a-ac21-2f1d5bbf85d3", "comment": "Malware payload (GCleaner)", "value": "cfe2f4ed303febf93910518d4eaaf9d2ad4cdafdb66fbdf11be9f3a88cc5a8c83e1c979117f18ea87eae5e5ebd0a88ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281206, "uuid": "39d8046f-4889-4349-af0f-475dcbab7f9a", "value": "T1D216CF5ACBA0F0B6D16316394ADB368C84385524DDEC1C816A6D3BFF0F2766057262EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281206, "uuid": "61010a3e-1c26-4b2b-b787-bb2f1619f5c0", "value": "d9602d58db63e796034d7dc7a7754fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281206, "uuid": "247330e7-ddab-463b-9532-5f1f6e9f6935", "value": "49152:BS89b0zZ2n+mWulaZbaZvsoCpdc81GrMGS9/hhhKhnJ93PMLI/TuNMC1mIEmi4:BS2b6N/50Cpdh1IPSthXgJZPKI/TWMz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281206, "uuid": "72f7b0f3-9f3a-4adb-b81e-6394315f57b6", "value": 4296976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281206, "uuid": "0cfd70b3-f74d-4908-b593-c44f697793bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281206, "uuid": "466e2d76-a381-4467-be0a-862ea97f1c37", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e312c-e6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1767234509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234509, "uuid": "8ffcbac2-c1f8-4274-9453-88505b787e0d", "comment": "Malware payload (GuLoader)", "value": "ba65b5dcb3e8b77d45d26ae9c09f892f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234509, "uuid": "9d46b615-72a3-4040-9d04-c7541d265d5d", "comment": "Malware payload (GuLoader)", "value": "431a3f4f6d893149da044869f5f228ec756dfe1e88569984d61e40ce08665aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234509, "uuid": "0182f958-e972-43c2-af72-8f3be7705914", "comment": "Malware payload (GuLoader)", "value": "907db3c3290a3ef147f66732f65520ca8e6c42ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234509, "uuid": "25c5e6ac-948f-47cc-ae68-55c8cb6cc23a", "comment": "Malware payload (GuLoader)", "value": "8de3050ada883944a6ee4166da852e0b8309ffd81ec09585bc1b4a10fe34568a24dfebe41f661a2bde5e88f87a0548d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234509, "uuid": "02f882ea-1f03-4e7a-8eb5-6852d0cb6859", "value": "T17CC53343F7A1D423FE6A04F244340EBCBFBD999043A00E47EA18BD5A3DC21965599BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234509, "uuid": "8a8f6a5a-5e4f-40e0-9064-f5d46ff10c4e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234509, "uuid": "0cbf5eea-0fbc-440e-9466-2077bad9dc2c", "value": "49152:rnsf64J4By2vytFje8Za2iajzHJKNedBEpccPeCjSS/Whr1uO:rnxA48NHRrNgpUCjjkrcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767234509, "uuid": "dadf5504-b09a-4469-a03f-23d3d716e0ac", "value": 2528200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767234509, "uuid": "56928c54-cde9-4e10-ad24-00e91a053f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234509, "uuid": "081a4250-ed66-45f8-bd28-10c3e0988228", "value": "SecuriteInfo.com.FileRepMalware.36346898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b96fdb-e758-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767302760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767302760, "uuid": "ee6b01b9-d4a8-4834-9c90-2d1e578e585d", "comment": "Malware payload (Mirai)", "value": "f7a547b0740b54e173bacfb99d804a27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767302760, "uuid": "7fd3a061-4f11-476e-8335-e99c3e0fa7d9", "comment": "Malware payload (Mirai)", "value": "43b9281c1ca30eeb8d8b393da3105b68202bcc8c9b06c83f70adcb53d7387f08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767302760, "uuid": "bdb8cef9-2ae4-4061-a494-3364ea9733ab", "comment": "Malware payload (Mirai)", "value": "7fda5aae0c3532d4d8938e5900377ca4f0586fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767302760, "uuid": "43e23a1a-0464-4ed2-bac3-53787002fa23", "comment": "Malware payload (Mirai)", "value": "51f884f70057a0e5572375e51a0a832ed1aae2e5916c627690fbcbcd465b108e843f4a3c2b811e1575a4cb916529414d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767302760, "uuid": "d2f6bc3d-838c-4973-8549-b9618c52a0f1", "value": "T1A2436D03648180FDC59AD1B48BDFA636DE33F8B902A5719923D4FB236E8ED205F8D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767302760, "uuid": "4750c5bd-ec85-4049-8b52-1a3c7a3b5aa8", "value": "1536:4xg7O/weelcrlV1yHXLK7Eug1N2W9VK1pDuWBo7/B:qg7O/reOpV1CXLkg1NRVWFuJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767302760, "uuid": "b195953e-d016-4eff-a8b4-29f4b742c840", "value": 59936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767302760, "uuid": "8a9ca9c7-f273-4147-9800-394616fa14c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767302760, "uuid": "787da92d-db81-4ed8-bc4f-740ac65a8ee5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14c345a-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767280093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280093, "uuid": "bafe1252-f55e-4df9-8d6e-d3353ae30ae9", "comment": "Malware payload (SalatStealer)", "value": "dadba105309017c22e34c85ad60aca06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280093, "uuid": "8fb07cb7-399c-41de-adc2-e01ebe0778ce", "comment": "Malware payload (SalatStealer)", "value": "440ec10db3ee296b542ede0ed60de02b4c815a686b8b70ab29268396344e4f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280093, "uuid": "a1b0db60-15dc-42a7-b79b-e27a5b833b64", "comment": "Malware payload (SalatStealer)", "value": "153fff3639c2e2ebe6ba383e3eca9b670a86c34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280093, "uuid": "d406aa4e-a528-4444-a3bd-faf59bfa1c81", "comment": "Malware payload (SalatStealer)", "value": "3d7351ac4d44055e7948b2c2ba1ac0c2043a9b582b77de9fbba6fa3db74e4d9d6471c8d32bf44a0c1248ba5877ec5eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280093, "uuid": "64f9883c-8ed2-459d-b48d-2b7b5dd0a4f3", "value": "T140E5332BCBD159AAC33CC83195B4F11408B9AEBF05BC12117D9B991906374F3879B3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280093, "uuid": "14c20ef0-7533-44d4-a12d-00ac986ada7b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280093, "uuid": "8ddb1df2-c25e-4356-9f12-1a1c78f4573a", "value": "98304:p1QpKwJ27IGwrdJ1trVyfhVnN4SI3vIUjRufnBUnUj:sp+OdJvhEVN9cwURuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280093, "uuid": "21dd977f-a8af-4671-88a3-24365b1496da", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280093, "uuid": "c2f17dff-92d2-49d0-b541-66a1252c0d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280093, "uuid": "f9b97022-fe2e-47bf-b8d1-282be7ab7ad8", "value": "CHAOSPHERE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4980ae8d-e750-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767299246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299246, "uuid": "1d8552bd-dd5f-4d12-b7ac-a68b5eb90dbe", "comment": "Malware payload", "value": "b0ff8684e316777e0cc9c98a815c0ff6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299246, "uuid": "109965be-c353-451a-a043-efed0efa0ed1", "comment": "Malware payload", "value": "446800befecf9179f9aca09dd88331dee0e745b199db39a9b0113f4ee886ca34", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299246, "uuid": "bed386cc-00b5-4920-bad3-ced7d8d28ec9", "comment": "Malware payload", "value": "a98da0ad4509a14967e7442d460a7ed53fbd1066", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299246, "uuid": "40311487-3144-47fd-a457-726f6a9bd8e4", "comment": "Malware payload", "value": "f03c472c26c5917c6cdb27a4a4008cb61eb6b5ebc18770ce363b8cb0a028362d32f67736aa076ca902339ac3b7b5a435", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299246, "uuid": "a9c3b8a6-403e-4ec6-b507-8522fe865335", "value": "T1CCB5E005BB989E1EC877D1320D0A5231A059EC27CB53C347D9387B6928AFAF44F167E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299246, "uuid": "c30f6c64-8b41-4503-a509-5e1731258dce", "value": "49152:R1eOvEfj1CtpkVNEuHUnPRKvKIcptrB7umhExfEQGD0G/F+9a:R1eOwstSVNEu0JccLr8hLg0WgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767299246, "uuid": "8579ce53-1d6a-405f-927b-ef49c2b73dbd", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767299246, "uuid": "71492f75-bb51-4b02-ae1f-d81d07906667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299246, "uuid": "2932b8f8-189c-46c2-bba2-f087d050a226", "value": "Chrome (12).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd7e954-e75b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304142, "uuid": "893841c1-ca00-484c-b8d2-386065e776b2", "comment": "Malware payload", "value": "dcfb65339d219f464560371fbd2f202f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304142, "uuid": "7a524968-080a-40d3-a65f-908a23bfa526", "comment": "Malware payload", "value": "458b5463a797cb8b9787234c0dafc14bb56cba52fd6a358a94face50bc6efda0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304142, "uuid": "d751ddd8-9999-42a1-adab-cefafdc233a1", "comment": "Malware payload", "value": "0f414296ea0a4a2d4e0501ae36bb5ed74cbf8548", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304142, "uuid": "1133c1ad-0e16-416d-8d91-d71b9636c6be", "comment": "Malware payload", "value": "a1fb12112c51c865fd98999a4d4c4fe80d84cdf4ff530f573e30c458adb5c236af3c79bbab307becec5b9b4a8f13a5d1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304142, "uuid": "6792bb75-a7e1-404d-b919-b800902bf444", "value": "T16855AD56E29811ECD5A3DA34CAA26233D6B67C054B74B1CF06A9F3052E73ED19B7B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304142, "uuid": "772de84b-cc1c-4266-9077-962caf57b38b", "value": "bc7b3218a10bbc5e849eff23490d7378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304142, "uuid": "db7f9e89-8063-47ac-be2e-5e86075e2cfa", "value": "24576:hRFYi7fgI00EQnWPnsvbV1UxHg8Z9dokks4IZNMNcPZeW3mC:hRFF7II0InW4AjPZRWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304142, "uuid": "306b9019-1170-4b67-af01-75ea10fee1d1", "value": 1399296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304142, "uuid": "6a8c74f3-c771-46de-b1d2-295e0f8fde34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304142, "uuid": "65351908-1d34-4420-8a8c-d8bf1171dc7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19b431e-e6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767240177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767240177, "uuid": "841c1fa0-31e4-4b06-b552-5006e34e88a3", "comment": "Malware payload (RustyStealer)", "value": "e3c95a39975b513b1ca0d9378f1ea11e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767240177, "uuid": "4971b365-847c-428f-ba1b-5e60b5518f30", "comment": "Malware payload (RustyStealer)", "value": "45c56406bfdbae77be9ab17a03b41c3a406f730db6bdc59062266f02534cfc4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767240177, "uuid": "3b02898b-71ec-49d3-a29f-0c21c41c7e3e", "comment": "Malware payload (RustyStealer)", "value": "bf8705ea4a4bc216a880b7901197d9296c21591e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767240177, "uuid": "b010f106-4814-4838-b5d0-be7d59b631bf", "comment": "Malware payload (RustyStealer)", "value": "b02753431318249460efe5117d74307b18c73500401994ddff8cfad583fadaf09895d691677123a5f9301999ad7b3352", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767240177, "uuid": "06159597-cf49-4280-8834-a8570896e098", "value": "T18B666B03F69181E9C4AEC174875B9333FA32BC8D5234B65B6B94CB212E11F60AF5E758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767240177, "uuid": "f3b775fc-d9ab-443d-b452-550511572826", "value": "9e00a9cb399967991f7df1accafa8b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767240177, "uuid": "5bba5370-8274-49bd-b1bc-1e7c24f55b21", "value": "98304:pzqFvmmxOeFdqdUZwIxhWJXgdFBZlZt3wWcnpbF:pCf0Ad/ncpbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767240177, "uuid": "d69baf88-a14d-436c-9a23-b11301ed0c85", "value": 6644736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767240177, "uuid": "6abda26c-d2ea-45b5-86fb-9c984e9cd348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767240177, "uuid": "3f30ea69-8584-4a3f-8f7a-b04f824b0de4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093bf520-e716-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767274227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274227, "uuid": "32b8ebd2-43a3-4d02-99a0-c45b103160a1", "comment": "Malware payload", "value": "2938083dc83ee894f8ff68ff3f2c90d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274227, "uuid": "29debce8-a348-4ea0-98d9-02bf6009759a", "comment": "Malware payload", "value": "4617ff5f4a194a51d8e885de4900b4ca97554cd01e73637f23bd27a3489502b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274227, "uuid": "655a9a63-308b-47c8-8617-3c9138103dad", "comment": "Malware payload", "value": "fee45a6b6a72afad79761b22128c9eb6692b8933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274227, "uuid": "5d9c187d-1f71-456e-a043-a885ed8e319a", "comment": "Malware payload", "value": "16835172ae19af765c575b052b6e02e6d3dd37450d414f38ad9bccfbe6705546249137ab9f0fa59d541e7312bb57de68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274227, "uuid": "5ef69dbe-2159-409c-bdee-214860863ec0", "value": "T15FE7494263EA05C4F9FBEA3589E65117D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274227, "uuid": "7439ae90-1f8c-40bc-8f49-cf864744830b", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274227, "uuid": "7c19478e-f93f-4cfc-899f-5bc935d45b9f", "value": "393216:bIFqKb+iUHdZQKPAg9hAJLPU689cN0DshEQu58EASEhoIaE2lShUcBs4DJ7G15P8:bndQmQJhnVn0vSa5rs3wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274227, "uuid": "3131c616-3617-415b-968b-dada194ddbcc", "value": 69789337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274227, "uuid": "e54eff12-4a84-4bb0-9028-4953c4c35385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274227, "uuid": "7124a024-21e6-479a-b316-1b600d00a85e", "value": "Matrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f7a194-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767280391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280391, "uuid": "f14eacaa-8fab-4993-a943-ab595c70b3a3", "comment": "Malware payload (GCleaner)", "value": "d9ad7adb0cb4a36f385edc2fb6777497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280391, "uuid": "72571afb-59c7-4a68-bda1-2aa5d2203d99", "comment": "Malware payload (GCleaner)", "value": "466f9fc7cee4b6482710d73ba6d1f292146fdfea17638c3875684833267c77f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280391, "uuid": "afa01b2e-c45a-41ae-b96b-f9592b896090", "comment": "Malware payload (GCleaner)", "value": "f69176fa556d09b1e7919a894e72bc65b2ab5b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280391, "uuid": "ad581b13-1d7c-4c23-869d-933312d0d34e", "comment": "Malware payload (GCleaner)", "value": "c8ffc3d3ddb1eb6536154d6c27b0bf60ef1705f7f912bae1e218decfe3d69090b7865846277550d37205a0624d167623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280391, "uuid": "8a1af3ab-2a95-4b6c-a6aa-34e41ed16443", "value": "T17D36D0F6D0EB0C33E6216AF44E7161371CA7AD0C286646FD16FDA9EB6A1D76C301413A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280391, "uuid": "b701a141-1c5f-4b4c-834d-11c8b2145a17", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280391, "uuid": "a8936e3b-c6b9-4406-b12c-6bc1265ce4e1", "value": "49152:N4nCVnxHpahFODllMz4FeSzTjm2LV3PqMmS5+U23d7vD7:N4nCVnxJqgDHxFeSzTjm2BCMcU23lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280391, "uuid": "e460ea48-dfa7-4d37-9660-e549b59d7f2d", "value": 5199632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280391, "uuid": "9b96cca2-73ba-4e96-a5c1-c52a7938645f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280391, "uuid": "64657b85-cb16-4654-b55e-00279aac587c", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8b22f5-e747-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295443, "uuid": "782e6f3f-0c37-4110-99b2-7ac6cd2e9ac8", "comment": "Malware payload", "value": "9d504332118678ca016415201c021934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295443, "uuid": "c21f1383-2098-4777-b05b-843d56b0b70c", "comment": "Malware payload", "value": "478f6ae5f0e42c96d26ae7d5a02305055e87410743a4072965fd7ef7456a1e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295443, "uuid": "68d5aa7f-ed9a-41e7-8f16-01c5cf3e4b0b", "comment": "Malware payload", "value": "d2d1291c58bf3def7da6d4c621d329b0eedc0b69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295443, "uuid": "4d67d5b9-394c-459c-98c0-9d2ab6616fcd", "comment": "Malware payload", "value": "e860cbb99c6876147561d7503bc925355fc5dae6bb9242bf6c2245b0fad132a2aa348393d264a77f6946099ac76cfb43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295443, "uuid": "89a9f032-c1c2-4658-a35d-743c5aa94195", "value": "T1A8834A84F783E5F0E84605B0006BF77E9A35AE221124DD6FDB94FA73ED71A42E15A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295443, "uuid": "8549f5af-89ea-43a6-b0d4-b08e195a2825", "value": "1536:ttHAQgh3fdYCenWi2GXxr87WtgSUg31UHxzWfoqY59azGorI:t2Hv6Bl2gxgcKFxqaaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295443, "uuid": "9ba3beea-5e26-4fbd-bade-0edb2dee5ac1", "value": 86756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295443, "uuid": "2ab98e5e-a6d3-4006-a815-57918f820875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295443, "uuid": "0edf31c6-03dd-4b6b-ab4a-51500eec7f8b", "value": "goon.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3503fd9-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226087, "uuid": "30e248c7-c065-45ea-8cba-8fec5b552d09", "comment": "Malware payload (Mirai)", "value": "e4de4514dd846bc3b425df17cc68df24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226087, "uuid": "c992ca96-fb61-4950-a42d-58cc0b2f8fb0", "comment": "Malware payload (Mirai)", "value": "488772ad4a2669549652a061d68937989c27457ed7b1f5864b54411905fc8512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226087, "uuid": "62b02e93-3901-4034-960e-38d1f6376ce0", "comment": "Malware payload (Mirai)", "value": "6be24e81c8469c02d7d0933314f535952d842c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226087, "uuid": "8b97bdad-b86d-4c86-b93f-44ccfee8f694", "comment": "Malware payload (Mirai)", "value": "a71e632387c5c6995147829be3ddc13384245d5e47a2c5a0a157e751b85b11d971336bb17f368826756c35dc58b3792a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226087, "uuid": "c3c29f25-44b3-4ed5-a41b-40a000c7be4e", "value": "T187534BCAAA43D8F5EC1A05752073F7365731F1352038FA8FDBA4E932B952752B50A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226087, "uuid": "b10d9094-111b-4dc9-b54a-15784a3d92c8", "value": "1536:pGzMEJvj3pjL9wxEWv3zWE69wtJs0W7EaNbSg77XHxLavR:pG4Uvj35h5Wv3zWZwtJs0+pNF7bR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226087, "uuid": "b5424d26-a463-4ac0-8b54-1f3bbfb3719d", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226087, "uuid": "f5eed311-a839-42f5-8324-15fbb428ca99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226087, "uuid": "bcbde161-ee6f-4927-b4b6-0c7ff792bb15", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ace2a9f-e6af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767230072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230072, "uuid": "b684d99c-0a1b-416c-b57b-d6bd5a11cfb5", "comment": "Malware payload (Mirai)", "value": "c3a9c38b4af60676641db21bb2b4fbec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230072, "uuid": "1cb0abbc-5ba8-4a16-b047-d2f60de37b66", "comment": "Malware payload (Mirai)", "value": "49980debd9a0795f1d02607622d8853cf0746fa4a5a507a5f7857a5148c4277b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230072, "uuid": "f83994af-8b4d-4c0e-9dfb-53ca3ccb3c79", "comment": "Malware payload (Mirai)", "value": "4a8d54755d28dcd9f5ac13f718741ac2d79ccab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230072, "uuid": "9acb3a5c-7c87-4e4a-a298-b21a17ad26ea", "comment": "Malware payload (Mirai)", "value": "47ba9f5c23e9dfdab67744463d53a79bbf6cf05504bcd8b47b6aec24146b24cffae899ffebd52f5441ab997eb4bd2745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230072, "uuid": "e3b4242f-de3c-4fd7-8dad-3beda0eca7e3", "value": "T1B563E846B9818A26C5D512BFFA2E11CD33276778E3DF73129D106F147B8A92B0E3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230072, "uuid": "35651d69-e46e-41c1-aba7-857ec3f3c904", "value": "1536:aRnoLB6viUByuPqgHhSsoEeHwe5A6n4KVhEmPyIAiOTpd/LK6uM7RI:FoimSuhSjEeHwe5Fn4KVATpd/LK6uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230072, "uuid": "51cab2b1-b604-4287-b7e0-7c086e79b4b1", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230072, "uuid": "1d27752a-48b0-485c-b41a-00ce8eb03eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230072, "uuid": "41cbd991-f6e8-450d-b500-acad034b7314", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a5b4b6-e746-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294896, "uuid": "9ee7bac2-a568-4f24-b454-8fbc04e9220e", "comment": "Malware payload (Mirai)", "value": "c81f88224191562f4253a813e5855d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294896, "uuid": "56ba6bcd-8138-47f0-971f-c5414c1c99f9", "comment": "Malware payload (Mirai)", "value": "4a488ebc2c03bd187f910292cc2a0aba51b229e1af5957f78710d4cda06b9710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294896, "uuid": "120e4bbc-e7f7-4e38-8e0b-aa953c50fb8d", "comment": "Malware payload (Mirai)", "value": "2a36d07e95da378ad29da53372ff68f9e0a8cfc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294896, "uuid": "cf81c4b2-0b03-422a-a953-4dfcbfa0873c", "comment": "Malware payload (Mirai)", "value": "5f38f911a0ef53c1df5fa881a9d4e7019633bb690d6269f89b571e0f2af873c3a797dc6ff3eba2a937e28a3f2cb2939b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294896, "uuid": "ddf1db5c-5315-473a-85ab-d73565b1427b", "value": "T108B37CA87A4F3C92E2C7E33DDE444E62701B75F5C72192F4BD02432DD4EADAA89E0512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294896, "uuid": "9c35511b-9537-4c8b-94c2-9d437435fe73", "value": "1536:gO3MQNWe727ubgCMkn7dmgpko8wJiqQqBgEm196sv2rSjRWUua/X4klceBCU:dF72YP7Fp/rQqBgEm9maWUDokWeBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294896, "uuid": "6dcfa6bd-eb51-4045-a9c3-ebc5512a9d68", "value": 116576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294896, "uuid": "f0c3d50e-a340-4190-8c3c-431bd7285ffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294896, "uuid": "3abedf2d-4e9f-4e69-9941-eec76033355b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5718a1b1-e6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229690, "uuid": "e173a2d5-7410-4326-8a73-de97c5f9efe2", "comment": "Malware payload (Mirai)", "value": "61fa8b531459e5d889771335f3484d44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229690, "uuid": "f6412d66-1285-49e6-b883-ee7513dc868b", "comment": "Malware payload (Mirai)", "value": "4bbc6f659a828440b6e26034f98e3595f9ba61be4db927692653ff5ee4b7b06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229690, "uuid": "c37730a5-25d0-4f21-a1b9-68f665607aa1", "comment": "Malware payload (Mirai)", "value": "9b83c2d24f0213820aea4d004d4f4430e86b442a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229690, "uuid": "0908972f-089e-4cab-b1d5-03f85b2d0018", "comment": "Malware payload (Mirai)", "value": "fdcceb177aaea1bda505c0674fa8ca634877b64d0b4d1275ab9592cae5b829358a15d0c3d5d12fe44f9acc89f918e266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229690, "uuid": "26999e42-519c-41a3-9ce5-b14362e4fe9d", "value": "T1B4530845BC91D616C6D462BBFA1E42CC332663E8E1DE7203DD21AF15778A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229690, "uuid": "b51149f8-3653-4337-84ce-625e9a87b326", "value": "768:eRlbqPDcKRs1/RgWdDPafmkYOsgS+uGGnJm98uJ9IHQmN7IZVBwzw8uJYcmu+7RP:IbxKoPafRY5gBu7nJHujsdIWzIku+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229690, "uuid": "f4b0f50b-c218-4f23-8288-51baec7fe18e", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229690, "uuid": "2a7d01d8-0898-4d28-bac0-b7e582c3e0d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229690, "uuid": "25b5f6ab-c560-4684-97f8-179bf854fbef", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f728597c-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229100, "uuid": "9a507fc3-3a0d-48cd-92a9-2017ec102c2e", "comment": "Malware payload (Mirai)", "value": "ccb1ba5611fd932e75daf0ce391ade48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229100, "uuid": "24d19283-c3c9-4e3a-9271-4893a0a62786", "comment": "Malware payload (Mirai)", "value": "4bd14db97f514cf8060e1fb5f659d9152d095eb9719c3bcb71f922fdfe8e56bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229100, "uuid": "633625d2-41e7-4368-89ec-a7a2ebada167", "comment": "Malware payload (Mirai)", "value": "8f0700db8a15f5d2ea41a87f6feda46a78a5d2a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229100, "uuid": "ffcbd4e8-7657-460d-83d4-27e68051f2a1", "comment": "Malware payload (Mirai)", "value": "ae7b998d3667970c987a32e4fc0a44724c5f042c4b944820cb8e944de9f61784b45134d513a7e7aa7e0e416603d1d5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229100, "uuid": "46d67f6a-eb3d-4f1c-8b8a-15e3449240b1", "value": "T1A5A34B82FC828A9ECAD023B5B66E668C335273F5C1DBB253DC114F1576C990F4D7AA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229100, "uuid": "556b9607-ae8f-4844-bbae-064f69fc35f8", "value": "1536:XpumNf5Yi4DAoxi6TGO1hbYwUnglXUq78ZYw0Az3L8F8oOd29pxenv2IymQY2AUg:XpumNf5nikfCZH7E5mmTn96hh1OeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229100, "uuid": "16cd6080-ab9d-416d-97af-bf93d68a7ab5", "value": 101532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229100, "uuid": "22a17bb9-76c1-40c0-97ef-e9b47f8ccef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229100, "uuid": "50ec21fe-9070-45a8-bab1-b936464e55ab", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097de008-e6f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767261772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261772, "uuid": "53ae4e7b-2a73-4304-bd55-7067a8eb87bc", "comment": "Malware payload (Mirai)", "value": "29df943fc53464dd769350c8803e33a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261772, "uuid": "e3eac82d-4d44-47ff-83c5-14774e58cd9b", "comment": "Malware payload (Mirai)", "value": "4bd82202aa1dc7bf3605e7951c113089fdee4e5fb0a29b1ae1207114ed998b53", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261772, "uuid": "9184a7aa-23ea-41d6-9665-5245661928d5", "comment": "Malware payload (Mirai)", "value": "7db6d520a0beb142769c8798ede3b8f517d8d321", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261772, "uuid": "ebfdd32d-e667-4fb9-875f-a8a91d954887", "comment": "Malware payload (Mirai)", "value": "e9a78dfc4c24530df34b66bcf019e18d963ae2afb53673f0ca3fb947e3cb67c89819e76a354a3601ac5121f49885f59d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261772, "uuid": "b33f04d2-0fa6-4348-a82e-de5ea5cb86b3", "value": "T1AA01ECEE45BAE993DB1C8E4CB0AA842CA581D1C57EB3DE84E83C44705CC71063065FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261772, "uuid": "37944c7f-489b-43df-b78c-68277f461769", "value": "12:3J3UUlxqQUUneKlCEQUUTiKl2EQUU7dKAQUU5QUUm9qQUUzFG10qQUUw1QUUk7IG:3J3Vx/lCaKl/7cRHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261772, "uuid": "e3ea499f-6514-430b-961b-e84e39025ed6", "value": 671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261772, "uuid": "36f16599-6374-4c6b-9500-975f9180ddbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261772, "uuid": "a3a0e684-8eee-4715-be98-b3bfcaeaf755", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ec1cad-e71c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767276962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276962, "uuid": "dc8f4dcd-c8a2-41a4-b8b6-357244cd0350", "comment": "Malware payload", "value": "c504be52c544ca4f780147346142f27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276962, "uuid": "7f656555-dff3-4cc1-81a0-faf757031013", "comment": "Malware payload", "value": "4c5365b303ef123e719005ce29b416403085388eaf642a6629b9008e4b575fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276962, "uuid": "684335be-ac02-449d-90d5-ff21c8611f53", "comment": "Malware payload", "value": "3fcb55c818119daa4bdd3808cf88802259f2fd00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276962, "uuid": "b2d83d0d-1d76-4998-9d1c-4b0cde3c5009", "comment": "Malware payload", "value": "634e5b7eb45f113178dd291d15886358bf141dcbbc734c25cb9d8c5e0fdd5673c3bfc474af38d22fc6846585440d99d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276962, "uuid": "15892f94-560d-4483-a49f-62ba36ead0ee", "value": "T17C376D83E8D21AD4C4AAC370D57A825BBA767C091B3823DB1690F7702F367D09E76791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276962, "uuid": "13cc3fe1-edcd-4791-a8dc-887971f00dfc", "value": "e953f99c923eaae61db9b69bfedfbe82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276962, "uuid": "b602ff1b-9670-43b7-af41-898a4aad3009", "value": "98304:gGN77BzZJto0tNTQJU7SQkVP1SxDbyKZBXu4+lMbq2ViK3gV4UbpU4LT1BU0XTKQ:gCPDJtTsJf1Sx3y+BXuCE0U/UNOKoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767276962, "uuid": "11b02a6f-8e1b-4c75-93ad-e4415e500084", "value": 23955456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767276962, "uuid": "1e073404-bde2-4763-9919-6e378941b421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276962, "uuid": "54dae9d7-d1e8-4157-a9a1-948bc09864ae", "value": "phantom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c9c739-e73d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291294, "uuid": "d6a44a6d-12e8-41cd-884d-3056884e55fb", "comment": "Malware payload (Mirai)", "value": "65a4a1c7222cd120fb74511198cf534b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291294, "uuid": "b12b1020-b45e-4d53-80ef-0543c690d97e", "comment": "Malware payload (Mirai)", "value": "4d3b5d59c3e66a1348cb3b9138ea102424abb07faca800c2ae8141fb14c2047c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291294, "uuid": "516da7c5-cf2b-469f-a923-3ba3724db10c", "comment": "Malware payload (Mirai)", "value": "4dfec5ca65d9ab4153a33ed480f87c97c45691ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291294, "uuid": "e6ca8cd8-6c6e-4db7-a670-a66d6500a893", "comment": "Malware payload (Mirai)", "value": "323c0828f5ec2a8d640444dfb3ee7b3fad8babecb57b6ec072e0a9d8ee19d1887158760e2e27853868bf7bfc4da412a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291294, "uuid": "4f7b441b-d710-44ef-ac47-ae14ec4f0522", "value": "T1C8534C52BD429606C5D51277FB0E828D372743B8E2EA32039D2AAF2177CBD5B0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291294, "uuid": "f416e8ed-1d69-4d18-9c74-9d781153ea84", "value": "1536:fPMhvjXlyMsyt2OWDlaZ/LpDUxpNeel9OYISWA2KfgP:8hRyaBLpDUxWenaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291294, "uuid": "61f886c2-c5b5-4583-bf21-600c1bdbe56a", "value": 65364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291294, "uuid": "b6328159-968e-4609-8195-ba55718ebc27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291294, "uuid": "6c41e57f-191d-4ac8-8d75-475f33e2cc38", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0eed23e-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233304, "uuid": "c95f9db3-729a-40d3-a58a-4b040a86bdd3", "comment": "Malware payload (Mirai)", "value": "3b54e325870c33761d90ac8406017876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233304, "uuid": "ced28958-1526-4cb5-bd13-54f015278ed9", "comment": "Malware payload (Mirai)", "value": "4d3f02a0fe5b5985e709b0ed1b1c75ae751ee0eedccf9596283d734ab77a7b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233304, "uuid": "431e94ed-a994-446b-a8e2-a3f72dd89af6", "comment": "Malware payload (Mirai)", "value": "04146f4ddd78c8cdb72f057bd273279bc438a118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233304, "uuid": "9eb8d71a-b28a-4eb6-9735-21b2f99897e1", "comment": "Malware payload (Mirai)", "value": "f1391bc397312b4fe65e10cd28367c8dc0a676cfe5680c95c479d9bc1849ea9be1c00abc63274281fca183192fc8d855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233304, "uuid": "d4f1cb1d-70d7-43e3-b14f-9e108a0f2b3f", "value": "T1FF043BC7F800D9BDF80BE77748170915B630B7E210929B336257796BEC3A1991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233304, "uuid": "957a9bde-6f4c-4433-846c-efb3545c2b8f", "value": "3072:tViw5bRs8d0cRQX+R164K99mGVJ2VijbiyLcsAS0yaWZkouh/FE8b:HiObRsRX+R1FK3vVJfLoyaXoJ8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233304, "uuid": "505d641c-52ca-4360-b76a-3d326b094640", "value": 175712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233304, "uuid": "39379926-798b-4b85-a692-03187ad8aea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233304, "uuid": "86c2082c-6e4d-4fc1-9f41-0590ee7b5a92", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af728860-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767254749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254749, "uuid": "d257baee-e11e-4859-99ba-c3b27a044b62", "comment": "Malware payload", "value": "b0449020d1053e7386311ec8767e6d51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254749, "uuid": "68d489ef-c4f4-457e-81bf-fa11c6c03a25", "comment": "Malware payload", "value": "4d62063f8b7edfdd8a5166e167ef7fe926a78e829285f706107e5fdc9696f8fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254749, "uuid": "4babfd13-5d83-427d-a523-c43c5a56c9d0", "comment": "Malware payload", "value": "9664785633abe25f8997915be5d3f6531e15c560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254749, "uuid": "3af69d16-f225-4136-be9a-8ec2295fc699", "comment": "Malware payload", "value": "a81278a8783e016061941d0ab10d1d3cc611b64455a0130dbf5d048347489de0d81c207c42bd93475c4ace28d3d04fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254749, "uuid": "b98533db-b1e4-41d7-8189-76d037f1dd59", "value": "T13AD47D58FE4E3C42E2C7E2789E4D83E1B32771E0D36391A37982421DD5CA9D9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254749, "uuid": "19f51eaa-5f8c-42fb-b244-c63bf5be00b7", "value": "12288:+IGZ4wTfM4UYOMqhQrNAqQm6WHeU7DpGkM6JXGJ0w5kXFub:Pa4wTYjQrNAqH6We/iecQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254749, "uuid": "fbc6977a-43ee-4513-8eda-799a2bdf39e7", "value": 634784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254749, "uuid": "f6ad3bea-dba7-4b2c-b995-59bc2ded0787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254749, "uuid": "89c699f7-6af9-4fa5-90d8-03c05799f24c", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a20b43d-e6f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767261773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261773, "uuid": "9650d386-9890-4c5b-995a-240ef4572a34", "comment": "Malware payload", "value": "dbce3ac91023586c4362039cdb9b10a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261773, "uuid": "940438f7-7b01-4eb7-91b1-22472d7fbf1e", "comment": "Malware payload", "value": "4ea4c1673e7eef97438aad7af44e77c11d152a4dd24b3190185c2e16ac0260fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261773, "uuid": "83854c83-0bea-4290-a7fd-10187fe097df", "comment": "Malware payload", "value": "299ac187eaf9dc54098a8cad675b9bce20856b95", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261773, "uuid": "b8546d14-3286-4a72-acbb-3feff5acdcb2", "comment": "Malware payload", "value": "2c71302786683299fe162f89cfd02261541f7195d35cce59d8d6e6f0d161e953d9255e8928329e1f07e5a685e2125c68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261773, "uuid": "208f13fa-ac0b-4571-816c-3ff7b9478da5", "value": "T115011EDE89617615028CCD44706E4A54F78E92C0B3B52F8A9A5904F35CE7741B06AF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261773, "uuid": "91c3e248-6f34-431a-8b66-88e5404c7e58", "value": "12:+Wbxq+lWtRH+lW8NIjlTBA+lW9iKl2E+lWm1+lWk9q+lWpFG10q+lWq16Z+lW/BS:ZxUMNIp3KlhVQ16De7xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261773, "uuid": "1b936670-1bb0-4076-bee3-9500941faf4a", "value": 788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261773, "uuid": "7696fd8b-d3ae-4802-8c3c-4e297e18f8a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261773, "uuid": "a50d105c-f367-4d6e-bf87-302dcfd18c7a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59245b32-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292400, "uuid": "df47f2ad-8b4c-4164-a536-250980f746f5", "comment": "Malware payload (Mirai)", "value": "14ca021254e43e43497d0670cebcd1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292400, "uuid": "d196789c-f6f0-4d40-aeef-e11ee40d43d8", "comment": "Malware payload (Mirai)", "value": "4ee7bc209ba65631040332d4937338d59a8bb2b1fe8fe7ec7a0e6ae2b2c2e346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292400, "uuid": "89970539-b5f8-43fe-8d13-02785b0e8e88", "comment": "Malware payload (Mirai)", "value": "3df91f07409e9662b4880cb52f1251ca3256642e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292400, "uuid": "bdab1df8-e9b6-4000-99ed-5676e228d1ca", "comment": "Malware payload (Mirai)", "value": "737b4fe37822e7cc78f95f52f38355a5b5236e146c6efa237648007437dd3780e3b6a003e3616b4429f0e904c95288a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292400, "uuid": "83a1c7d9-fb94-46ce-91fd-a84a7771c99d", "value": "T174148D68FE4F68D2D2C7E37DAE4A0FA231277D749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292400, "uuid": "90754573-4a63-4024-abee-f596d07a260b", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxi:bOVfbEdxm4iubI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292400, "uuid": "6159b5be-9e09-4db0-af98-5b29c04e4699", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292400, "uuid": "a962f4d8-272d-4c11-b5dc-378433791dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292400, "uuid": "1ec1d0af-8fc3-4136-8c95-5cbeeefcd0b7", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c564b1bc-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254786, "uuid": "c0a1ff43-276c-4b5b-a0f9-8465a67bfe7c", "comment": "Malware payload (Mirai)", "value": "1e0a7ce58b09ff87faa567ea314f656c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254786, "uuid": "8e2b77ab-8914-4414-a5ea-33765792c40f", "comment": "Malware payload (Mirai)", "value": "4ef5dfaca84140897816f79fc8998a53280921657b0fb8f552bc9c15d5a04335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254786, "uuid": "23758780-efad-4acf-90a7-ff46fe4f90cc", "comment": "Malware payload (Mirai)", "value": "b8b673f04f96c75a4231c190034a23884e8905d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254786, "uuid": "bb8c4374-72c0-4e9e-8859-a7ecc38357e6", "comment": "Malware payload (Mirai)", "value": "10cb2359a151c815135fadef6e180fb73a448c99c4098ab6eeb18bf0f816827cadb84e788b8bda52724f8d560af2d62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254786, "uuid": "6bb9c122-877d-4f24-8ea4-79fc5a597c1f", "value": "T179832A077980C0FEC49AD0744BBF7136D423B4BE1379B29A63D9EE262A09EE01F19755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254786, "uuid": "4c9b08e2-0bdb-4c3e-9ef8-174b383e4764", "value": "1536:trDmwmxI4hK7FgC3qxjTCl7JRt0UR8uzDTn7CsHqIWP:trDGDhK7iC3YTCzRtSuzDTnmqqIWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254786, "uuid": "dc60758b-87df-4d90-b600-c13cc4596693", "value": 88144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254786, "uuid": "73e14807-e6e9-45c7-a01b-1b0f4a59fe68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254786, "uuid": "005cc880-e8b1-4b6c-a8fd-5357c0d4e4f5", "value": "m9x7k2v8b3.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ed80f7-e6dc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767249360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249360, "uuid": "2bac15e2-999e-4041-82a1-9a5ca78aef47", "comment": "Malware payload", "value": "0526c24e48f2f01d06b1f2167af0ea0a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249360, "uuid": "67d9cd97-af84-4b96-865b-75236e5d7aba", "comment": "Malware payload", "value": "4fc3843d7f1f83565a39136323bd2fb46d5433454746581648f96e50e0cb435c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249360, "uuid": "7739af98-783a-408f-ab7b-484689ac8592", "comment": "Malware payload", "value": "9a3edccc7e72017543036e256903d42256498f4f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249360, "uuid": "a158cfb4-10d3-4ccf-8935-affe3676f984", "comment": "Malware payload", "value": "665d65536e0e57c20eaade59755673c4d00b82a13dff58295da0b4efb5993cebaf638dba87f1c0f92fe53e69790ba18e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249360, "uuid": "07c49a95-6927-42e4-b41f-c6a52fea4698", "value": "T16A1134ED02D493025D6CEE487A59811DE594B7C1B8B0AF79F4E48478F9DC20B3164BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249360, "uuid": "4b2b700b-9b5e-4e14-8999-7fb08c3e5f62", "value": "24:3J3L++zAtNIKiERK0GU6diFQhMdVBm8k9IRJ6dG4u7dMHA:Ur1aVEUNeMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767249360, "uuid": "5f822ae3-1ca9-405a-b9cc-4cddc9fdb0ea", "value": 1008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767249360, "uuid": "3d0221b3-51d2-436f-bba0-0c3d1244e802", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249360, "uuid": "19d88a98-c249-4549-9d7a-f082b2f5041d", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1be4d87-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233359, "uuid": "c60f9bcf-5b80-40e5-8b53-0e7782aeb679", "comment": "Malware payload (Mirai)", "value": "62688e05a86bac9ade653ea5b5f1f4ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233359, "uuid": "8c4cae33-8d44-47f9-9910-2749b5786657", "comment": "Malware payload (Mirai)", "value": "505f5e661408d71727eacf62a12e03cbb19fa466d4281d3094817f05711cc1c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233359, "uuid": "ad8814e1-cbf4-48fc-bd4f-648ec02e57d6", "comment": "Malware payload (Mirai)", "value": "a818a3131bc3d64e8f278147721c17c201498d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233359, "uuid": "f9f545e6-26de-4282-9957-00800f8d9b9f", "comment": "Malware payload (Mirai)", "value": "57e752bce9d45aa6d3ab161141b4243330d9ebcf1eba35b526bee47a3535b313f0fe4ee89b455d20bd3a93782c39d288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233359, "uuid": "1ccc7065-4b1d-47ca-a984-44749c44a3b8", "value": "T1EE243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233359, "uuid": "0d38f3f6-63aa-43af-aad7-0c593b7e4450", "value": "6144:VvERpNp86wS0WI3NyaLTsOZWKva6AqeGTrkQ9M/R5S/wmH2WBLB5n:aRpNp86K3NyaLTsOZW0QwMQG/K/wmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233359, "uuid": "ad0ef96c-b021-4a4c-9f50-9295a83c5aba", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233359, "uuid": "54b9d2d3-125e-4729-9733-31542287651e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233359, "uuid": "d2ecf07d-4848-44cf-9e07-e9af597cc231", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfa5118-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254744, "uuid": "1b1d0013-8357-4b63-a1d9-2182aeaa1f2f", "comment": "Malware payload (Mirai)", "value": "335f942514776b7ec460851aef149762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254744, "uuid": "5cde28b3-16b9-4285-8a60-5eefecc91ea4", "comment": "Malware payload (Mirai)", "value": "50fb71af4bd1a64094411511e589a57204996c4d710205183077c33bd519a691", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254744, "uuid": "ae6d331b-1fba-4027-b1fc-c73bf4e648d8", "comment": "Malware payload (Mirai)", "value": "46180cc23f9ab14c69d367889817442e3d1536b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254744, "uuid": "86c86ca0-bbf4-4fb4-afdb-c4bf082fbbed", "comment": "Malware payload (Mirai)", "value": "af7e2fae1ad4080b3324315d9f0d975d77615f859f9c61de3c99b1282657acf07946421c5a00c43298eb12b55c8b0bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254744, "uuid": "c2cca5bd-0d7f-49f5-b94f-786f5138afd0", "value": "T1EF13E128178215E9E8BEF7790B968FA43DF52FACB6838C845D44F5875FA116420C3BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254744, "uuid": "88c79c6b-7e8a-4768-b5fd-8598b814d942", "value": "768:0pfyczYKDqEhkwk0CuRkvru68189JkekIQE2ubdOnoDAYV6aCTJgGlzDpbuR1Jam:0pfyczDDJDhSu68e/k0dDAYV6aCJVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254744, "uuid": "c5bc5d39-dc37-4ea6-a562-027a5b4df9b8", "value": 43844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254744, "uuid": "894442ce-fa0f-45a3-8898-8a3b07bbf40b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254744, "uuid": "7055fa48-b9e6-43a7-947c-827e8ba74150", "value": "m9x7k2v8b3.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c371bf05-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226436, "uuid": "19c8ddd8-a726-49da-9b27-a923b03569d7", "comment": "Malware payload (Mirai)", "value": "c83d3d5acc7eefc76b773efa642374c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226436, "uuid": "1910a86b-719a-4752-a554-0701dec431ac", "comment": "Malware payload (Mirai)", "value": "5101d99ce465c210ff6cb57aafd45c0663020403fcdaffa0132a486cea4bb871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226436, "uuid": "0ffc3b67-468a-43b0-b3a4-bfa6826196ee", "comment": "Malware payload (Mirai)", "value": "2d937980033a8bf08557ae6a846248c4348150fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226436, "uuid": "544325fc-711b-47d1-ad1c-b5c6ed0fa7f3", "comment": "Malware payload (Mirai)", "value": "19891ae05253962aa13f48cd352fe4d6615801165fccbe8ba533953b4b2a44eb27871e438157b61e016210c0f8a4444b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226436, "uuid": "5281ba2b-529f-445a-9c9d-42502422f255", "value": "T1F4537D26D46AEDE8C14C85B4E9B1CAB56F43B200D6432EB76A89C5594047FACF70E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226436, "uuid": "7bd1d2f4-af9d-4f07-a638-1448e3114d32", "value": "1536:jajwtb1EZ74GfQYpdXjRvt9UyU5bxMjuC/Eu+7R:jYiEyGYYjXjRFCyabmjuzu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226436, "uuid": "ecb2801b-5264-493a-ade4-1a99c14e0a1a", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226436, "uuid": "714aafac-3e07-446d-ae01-bcfc8966435e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226436, "uuid": "0e313b00-802c-4911-aa3d-517910d16461", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a639ce-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295991, "uuid": "00e5ff5b-6bd1-4720-8979-8a95503349c7", "comment": "Malware payload", "value": "1aafd2f4db3e7152fff17a4b3b3a5f65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295991, "uuid": "d3a12f2e-4c26-4b92-a756-ef71273f257c", "comment": "Malware payload", "value": "5139290e059e4802e13868753c5e3784c4f508bb25ef3cfd5d3545e90272d3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295991, "uuid": "27d823ef-513b-404c-9537-eec5f4bd83c6", "comment": "Malware payload", "value": "421bc6647e944fa5fee0e9307e0f8aa0d286e6f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295991, "uuid": "24214a17-487f-4639-8077-461bc1fcf6d3", "comment": "Malware payload", "value": "bcb4d147db1de090b7fb88334346c0fa5cbc5a9001dac22abe8c25690880eb358f6ca7a785130ca751374f9031fd87f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295991, "uuid": "9b549af4-25ba-4dca-a171-3bd5b781afc4", "value": "T1ABC3F756BC419A12C6D156BBFE1E92CD33231BB8E3DE32039D186F2467CA91A0E7F451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295991, "uuid": "ef5cd169-4778-4c67-8fea-6c41d1211f21", "value": "3072:f91VtmN6yxhwaF/9tDoBPKICBapv0UncJU2XiL2CZI11X:f91VtmIyxhwY/9tsBP4Bc8G2yL2l1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295991, "uuid": "9a4ab64a-38d1-41f8-8f24-b7e5a1b06096", "value": 121068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295991, "uuid": "8e66752f-65a3-49e8-bd85-9f72f7a1ea3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295991, "uuid": "18e9e93c-2ba7-438b-8bcc-f4da045b9fd5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c47466-e714-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273368, "uuid": "aa123a01-736f-4a9c-b043-cd03224cac58", "comment": "Malware payload", "value": "967834c8f7507afd44c4df0e0feb47c5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273368, "uuid": "5a390504-87c6-4e56-bf6c-7166db306f04", "comment": "Malware payload", "value": "51597042b698fe653ebaf6def330539b0d44f19650a42a43457259cb3eab4879", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273368, "uuid": "99aa1d85-0b9c-493e-bc93-ecd3e2587b31", "comment": "Malware payload", "value": "0b634702d52b3372b947225d4a61d42ec92ed305", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273368, "uuid": "f742c977-86c9-48ef-b932-d76d517a11a8", "comment": "Malware payload", "value": "b9761cf12781030fedc2d9859433ed14e1d971f2a68d06a5fc60eae3469916bf08f6cfa5fd639177b8a21ebce81a9d62", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273368, "uuid": "6ed86daa-94db-4bc1-82f1-39b08b2675f9", "value": "T1B0E1C686BCF325197407905DCBBEB2587059A057870ACD9CFECC65A8DF4C2A89622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273368, "uuid": "7fac0baa-3460-49dc-abe8-6a09253c81eb", "value": "192:OZbIE/CTK/e8K0llHYoHsfOBro2Tc/O2Smy:Ob/5YoHsfO2/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273368, "uuid": "2f79faec-b964-4d3b-a27e-ab513e234795", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273368, "uuid": "9f406349-a4b0-402a-939f-d129f4925699", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273368, "uuid": "ddabde6b-df70-4d94-817e-b26ce81bbe56", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924c6c22-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767252982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252982, "uuid": "53ca7685-3adc-49ef-ac5f-5017d6eb7621", "comment": "Malware payload (Mirai)", "value": "c8c538a05cf18cf120130105b47032b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252982, "uuid": "33281701-baf4-41a4-b33a-cc20b1586cc4", "comment": "Malware payload (Mirai)", "value": "531ca7efe0b460fa89bb5bbba7ae474e19e44727dd7b7207e6d80c6aef604b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252982, "uuid": "c057fb4f-2090-4d5e-befb-30d69b5f0d79", "comment": "Malware payload (Mirai)", "value": "d955e47d88a56592915165e47e2964ec97a08c3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252982, "uuid": "ddd43f99-486c-4185-aa0c-7f3e33bdd5c4", "comment": "Malware payload (Mirai)", "value": "31578d7f4905a9413b223cea9f5ef2a60ec56733a21b42b078f8c1d7762f5f87d2ded7b8b5e0c72edc9a1a1578d45d3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252982, "uuid": "4eed0544-9fc6-40c9-a1e4-57557637c96a", "value": "T10B733B81BC815623C6D1127BFB6E428D372613A8E2EF73079D266F21778B85B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252982, "uuid": "4f1dbc57-dec4-45e1-92ca-64c8a59768be", "value": "1536:e1CbYM80aak3sYboBR/FEkhnjD1PoqAGtvd:eMbYajR/FjDN71d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252982, "uuid": "b40dbf91-d311-4465-9b03-7c96460f7c4c", "value": 75988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252982, "uuid": "a04f4fa5-4d8e-4c69-9acc-227ab7dd1f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252982, "uuid": "f6a4f341-0c62-4d6e-a3ea-62d4d542a5ca", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94c73ea-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767229050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229050, "uuid": "caee9138-0623-48f4-91a6-3a42ade409fe", "comment": "Malware payload", "value": "e4047e0f60aa5e422619079ffdf8fa51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229050, "uuid": "8ce3ae22-0653-4931-99aa-79284a1df692", "comment": "Malware payload", "value": "534c0450bc21d1261c99c53c720183adb0a442c1d001ec096f339cd03f98180a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229050, "uuid": "c6925bec-600f-47b2-a25d-227efa27bdf6", "comment": "Malware payload", "value": "b24e43f134167f2d014b3bc4fc6725a756c9b22d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229050, "uuid": "25cdb069-b48b-4597-b509-3923b5566a1c", "comment": "Malware payload", "value": "a62de00c7cd2888ea6e11f20d1d4e51a8604160dcdbcaa161166fad0994f0fff876cd358dfe626d23289cd81cf9cd287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229050, "uuid": "f2f64c69-3ea3-4b28-98b3-e1ad205fba35", "value": "T18DC35D03B328890BE2F70FF027FB43E1936A569165F4E286360597494576B729A06FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229050, "uuid": "34a1a82b-6778-4405-a996-90e431d59deb", "value": "1536:fxzFuWbWuzbdtWlqSQwKwdsOYax6hHsOfQND0mpKXIDCHTcb0RRSA++bhrs8:fdxbWCNSQtwutagzQupI2zcDSbhrs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229050, "uuid": "aa9c8cbb-517c-4dd0-b6b3-2d7557fc4a55", "value": 120344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229050, "uuid": "37e38419-ffbe-4a02-af69-280c7ab3db17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229050, "uuid": "d8a60db3-b62d-4126-a4a4-7706beaecbeb", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5eb6fb4-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292556, "uuid": "3f56d1dd-b394-48ec-9281-5e30b14fd7a1", "comment": "Malware payload (Mirai)", "value": "8f398ec3735a7c044cfc4c9b30027ad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292556, "uuid": "11504675-80aa-40f9-9efc-ce2b801a1e04", "comment": "Malware payload (Mirai)", "value": "53662f19f774a6f0edcf5a08f5e4091731878fc8115e43a2e0e813cf717bcdb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292556, "uuid": "b8d4593a-58c8-45e1-8fcb-57824391fc73", "comment": "Malware payload (Mirai)", "value": "b6dd800709fbc60ac055d614713eacbde7e67762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292556, "uuid": "7768a4ea-2ff1-4a0d-b010-24252837ddf0", "comment": "Malware payload (Mirai)", "value": "9db60bcb04510fae8af2968fa439e468a25629b8df2217fbc4d79d6e8fc17fc7e0e0a8238b78c20a724a58111042b5a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292556, "uuid": "8c6e3e08-92be-4a1b-a1c4-77e1ea667256", "value": "T1E4043966BDD2DE12C5C011BBFE2E518E331317B8D3EB72169D102F21678A96B0E7A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292556, "uuid": "225dede2-d35b-421d-be42-2957884c3ab0", "value": "3072:BCVi/+nklvfB97ymrIhNT1HRzTeStmJZF2U4i1z+hMAmCwhlrRaTCg9mUU18qz:BCsakvf/brIhfHRTxw91zUMMwjlaGgfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292556, "uuid": "a67c1aec-d680-4e82-a1fa-11beaf807131", "value": 189908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292556, "uuid": "3d9e48ef-0e09-487a-b051-e6fccf35ea66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292556, "uuid": "9ca91794-4af6-498f-9330-d17096e374a6", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6884f8ed-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295433, "uuid": "f1f87b4d-b45b-4a1c-b871-ab2c9be423a3", "comment": "Malware payload (Mirai)", "value": "b64daca17fcd230f95a15e16b3a5a8b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295433, "uuid": "3b90bb2c-7709-4ac5-9c91-a846362dcb15", "comment": "Malware payload (Mirai)", "value": "53bbd7c539ad49a5d70d62312b220e360b0af41121168a8ce307457c0dd77229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295433, "uuid": "75395878-af45-4b7f-b36f-ff80448394cb", "comment": "Malware payload (Mirai)", "value": "f2f0ea4b9a9c2c86ec3e69dd651174fa1d428ec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295433, "uuid": "3b7fa7b4-4a66-4365-8fbc-c41c87d2bb37", "comment": "Malware payload (Mirai)", "value": "8e8e38fa6f89bde25ef60a69bcdbb668cf9e02b582852a57b6ab648f52a2f28937d58c1d5fb9d06ab0167aa00c63f597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295433, "uuid": "e9052f49-1783-472f-937c-9e2cb80924a4", "value": "T14483F881F9829612C6C152BBFB6F418D772653A8D3EE72039E256F2037C782B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295433, "uuid": "1f7d105c-448c-4181-b486-ea2d8cd0f378", "value": "1536:TSckJQayBLOrVZjDConS8gD/TpLHQDImU668cAxaIdjGU+HIX5yDG:TScP+jjDConS8gpL9mZ6tAxIIJyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295433, "uuid": "a696ea08-eb54-4cbe-b020-9f1b1070ced6", "value": 83348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295433, "uuid": "c993b917-5a46-422e-8f24-694c2669b5f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295433, "uuid": "d07f0101-505f-4d22-98ea-706e4af9b463", "value": "goon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bbdfba-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254782, "uuid": "e39837ff-21ce-4cd2-98d7-3b3de14c019a", "comment": "Malware payload (Mirai)", "value": "35ff95a21d5406bb631fa05cff22df55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254782, "uuid": "663d65b0-a4c2-4c0a-849a-e2a141ccca0b", "comment": "Malware payload (Mirai)", "value": "5461e3e2e5ec985add1b8292bd8ffa5cfd8b3c6c5523c682af3720db63c24050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254782, "uuid": "64d0193e-4ef4-4547-a52e-155a02d1b9bf", "comment": "Malware payload (Mirai)", "value": "c42acd704b0d0793c8d76eda0a66caffde11113c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254782, "uuid": "eb2a14ce-3af5-41e0-91e8-fdb0c5b798ef", "comment": "Malware payload (Mirai)", "value": "031077396e8be61dc91c918ad34210dab8da7b90729a29a652143ce5cf4246acdf96c11c27bf82feb058807beec4bc95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254782, "uuid": "9b40d778-8e2b-49dc-a242-bcb900014f72", "value": "T19CB3E80E6E318F7DFBA8823447B39A31975923D227E2C685D1ACD6011E7038E645FBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254782, "uuid": "44026bb1-3e0c-4b93-92c4-b20fdbbc5960", "value": "3072:BnDXvARm08njjq4eJGe/8203OOdvlLcTR:ZARv8njj3eJGeN0e4LcTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254782, "uuid": "be29afc5-708f-42fd-a71f-476098876000", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254782, "uuid": "66cedf58-8ceb-4294-a9ed-146c21cb9b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254782, "uuid": "b7a5e44b-566b-4310-a992-95d972b09e15", "value": "m9x7k2v8b3.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1836a9-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767226805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226805, "uuid": "bcf1ac5a-62d5-4ff8-ab01-b9f474fe8a2f", "comment": "Malware payload", "value": "5a163d4dd7ae5854e5a30a231347c755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226805, "uuid": "9a6d6626-3e81-4403-a586-ab5ea5bc30ad", "comment": "Malware payload", "value": "546e222dba22ce3182bf08dc37e47ea0cc0cae58cae3ea3586dbd74b572adcf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226805, "uuid": "51551db7-a1f6-478f-b2fa-78acce81f6a0", "comment": "Malware payload", "value": "2ee986f1588d3c2ad06593e00f6120aa19361548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226805, "uuid": "1476176a-477f-4d83-bb94-f5b11aa4cb8a", "comment": "Malware payload", "value": "3b0b791d55973bdd53937ca10910e98546a383597e1b71c38fdb70145061c428bbb127b41ddbe669f38337dd6e55c270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226805, "uuid": "4032389e-1a9b-4e26-bcf8-1eb2870380c0", "value": "T1FDC35C02B328494BD6F71FF027B713E1A36BA79156B0E682760993494176F329A05FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226805, "uuid": "69d277ae-5e25-4a25-a7bb-a0b88dbc4e79", "value": "1536:QdmyQeWg/4oBJNwqd/HJ/AWU59hQf6tDYDBgOvYXtXQsnz/XPaqxpbRYXrHtfLWx:+Xd/4CNVbaRtCB9vY9lzPobNKZSbhrsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226805, "uuid": "1c971462-54d2-4207-8684-53b4ac674cb4", "value": 120344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226805, "uuid": "b5e16986-55ff-4e65-bf7c-d17c6834cbb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226805, "uuid": "96328a02-ae7b-4bb6-a606-37c781dd5367", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236ea6f5-e749-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767296176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296176, "uuid": "ed06684f-b248-4dd0-941a-0e8c215505e4", "comment": "Malware payload", "value": "e2948707b459e85a78b9361e3929ccfc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296176, "uuid": "471e2a5a-7913-4771-94aa-e71bbfb1f863", "comment": "Malware payload", "value": "54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296176, "uuid": "efc8c0c2-4e50-4cd6-902e-a0cddb66c7f4", "comment": "Malware payload", "value": "f509b69b543e702cbccc8b789903acbed77ffa12", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296176, "uuid": "81a83a1c-b836-4a8f-b40f-9006e27110ee", "comment": "Malware payload", "value": "e50d5b887e486e35255b181daa3d6ee70574f6633cf9487939b13653486f7956c0e2a7417592701e92e12b2fe83116e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296176, "uuid": "dc3b3c7c-4c13-4c96-a2ef-fadc4b8a8f34", "value": "T112017DDFD871761103CECE45707D4958F109D5C063A26F9A9E6944F64CE77493026F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296176, "uuid": "78118dd7-3de1-4a75-9d4d-5846457df80b", "value": "12:+WbxNWt2W8NIjlTNW9iKl2DWmY7Wk9NWpFG10NWq16aW/mW1WqbUWoRn:ZxMiNIpXKlnR+16VSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767296176, "uuid": "bdba2c2f-23cf-4aee-93c2-3a19c61e4845", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767296176, "uuid": "fbe3e412-6897-4e09-b96e-ff6e6add7c0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296176, "uuid": "afc9c8d4-1d82-41f8-8a33-52bdbaf42c9a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fab0e8f-e6af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767230134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230134, "uuid": "f18d4a3c-a9fd-4176-87bc-1728efe9b86e", "comment": "Malware payload", "value": "dcd8b4026bc94540b00870179565e52c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230134, "uuid": "b0f4e3cc-fe88-4713-b947-8e542f8981a7", "comment": "Malware payload", "value": "554e2b5ae82073d72bb8fda4451cf9686c8b8452c60a83812da1acbeacd876d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230134, "uuid": "faca2448-1307-4a0a-8cfa-44c39db56b71", "comment": "Malware payload", "value": "10ec408c885818e9ccb1b6a2cf19eadf70cc42b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230134, "uuid": "db0bcf4d-39db-44ac-a90b-813ae061a18e", "comment": "Malware payload", "value": "3b8a9db8018f2091631b8a1577b532e526e193b36ca6692325ca450e58e32d2476d7ceb369dec3c3d47a453b709b4239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230134, "uuid": "3f20a008-d61e-49d6-8dfb-ee77a4d20cba", "value": "T13AB73363AD4659B2ECCAC43695EB42ECD218B40657B601A7075D0DFFEC54A838F3938B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230134, "uuid": "0c5633b6-1968-4fc2-89f0-8a784755ac1e", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230134, "uuid": "a5b4a84d-46f3-4742-a459-f71a994a2265", "value": "786432:Uhdrghs50yh0TT1V+1EVALZaVi1BCwFectjpfFdCL1Dxl1p4YXM9CGA7M61:4f5WTT1mF0g1BClctjpPm11lgYXwXq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230134, "uuid": "72689ca6-c736-4915-a8f9-7348472cad64", "value": 48814359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230134, "uuid": "d1eb20cd-275b-4bd4-bc6b-6fce758c56f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230134, "uuid": "309864d2-99c2-423d-9af6-64bdc5540445", "value": "link_to_android.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69322abe-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295434, "uuid": "b526a722-c555-4c57-a01d-7d11f9caa33d", "comment": "Malware payload (Mirai)", "value": "1828882605bb208cc93e828d2eafb794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295434, "uuid": "c1015d54-84b2-45c9-bb94-3475a5ffbf2e", "comment": "Malware payload (Mirai)", "value": "56cc6b73697f6855f17caba06310487047f3e184d4f7b237acdeb23b8b0b1510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295434, "uuid": "33e8e308-0fee-4a36-8afe-14fbac3cf34d", "comment": "Malware payload (Mirai)", "value": "3d3e2730ba662555463579d699f1812fb1e49267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295434, "uuid": "66258b65-4446-4440-ac3e-14730f1f6ec2", "comment": "Malware payload (Mirai)", "value": "de83cecb8efdc926ce2b70ca025c189ed2710e10ba0b25ea137f734b635619ff51055ae89ac87f8c0050fe8733a798f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295434, "uuid": "6e5dd162-536d-48db-9105-770d05f5e834", "value": "T117833B42730C0A47D1776DB03A3F57E093EEAAA021F4F684255FAB899271E365186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295434, "uuid": "5cf71ba7-7550-4475-bba8-fba76d5fa9bb", "value": "1536:XxLLavjQgCzXqoqqBZkVRuOJOu7jBqeoz+JqDfpgesojQFWW:Nwdoq0kZPo+a//W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295434, "uuid": "61f868c3-f461-4324-b517-4e983523f1b2", "value": 84200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295434, "uuid": "3cbce442-46e8-4e03-b4e0-0f5b1690bb6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295434, "uuid": "dda9b38c-cad3-481b-804c-e2152b611ba0", "value": "goon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c2b513-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227351, "uuid": "5f347682-336a-4b6d-92f9-82db4964e8a5", "comment": "Malware payload (Mirai)", "value": "fc22680950e40b6c3272eeea3eea5654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227351, "uuid": "bba1a8e8-4676-4bd2-a3c3-485c4932e561", "comment": "Malware payload (Mirai)", "value": "56d45614fca4945712e1a834a3fa9d653fc1a6817cd55f6c106ce1dab925c686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227351, "uuid": "58ec653c-cb4a-4fe0-99a5-9152093019dd", "comment": "Malware payload (Mirai)", "value": "0f691c7c9f2da6293b85a9a02e8c0b5ade67d8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227351, "uuid": "83281abf-3e5e-4486-82bb-7b099dd3e779", "comment": "Malware payload (Mirai)", "value": "5a793345b44b5915b62b0c238418bf793cb6415e056f112dbeddc5489c54fe89400c52626376d300ce0349b1a9a3c362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227351, "uuid": "aec061f9-45ad-46a4-8f2e-bf28dd268e88", "value": "T14163F749FC815F21D5E822BEFA1E018D336767A8E3EF7112DD101B15778A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227351, "uuid": "3cf38c20-0c6f-4e8a-a692-a8edfbc6c426", "value": "1536:m5ngC5jO58qBZ6rQpsASs5qwQDNs/tynXnbTNlw7iWhXxB1ZXu:6C5gu3SmqwQDNotynXcPhBNXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227351, "uuid": "1b06f0e5-8ea6-4a22-ac72-1ec063760612", "value": 73028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227351, "uuid": "c3010312-e8e4-40d2-8c02-21ec790f17b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227351, "uuid": "09b4d257-0bfe-44c5-9aa0-d4aeb489d620", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513128c0-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270483, "uuid": "68e9fd8c-7b1f-4a8a-b032-1868a7f85c4f", "comment": "Malware payload (Mirai)", "value": "c6e8bca0ddcc5ad8741bdffc3a5f16d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270483, "uuid": "702867b6-7754-48d3-9518-6925d32031f7", "comment": "Malware payload (Mirai)", "value": "578d0cbfcd015bdf1a8158334004aa616f65b33b73d717050ddab299a6afee30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270483, "uuid": "98ffb5ce-b740-4851-97ba-69a02351844b", "comment": "Malware payload (Mirai)", "value": "06d0f2ff0f695d692d52951c5eaa2f73f48c64df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270483, "uuid": "7fae7026-9dfe-44b0-8865-6caec9c5b597", "comment": "Malware payload (Mirai)", "value": "661f1c9113378864b83df9c9802da442765ea1c9d95baaa942c45fef4fbe5d0dd54d00f256a2a2a7fffe0e6334765414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270483, "uuid": "4ed3c07a-6dbc-4249-971a-a73d3aeb7f56", "value": "T19B73B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270483, "uuid": "4249bb55-ad64-4e2a-8a8d-1a9751a6a6a0", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGB:aHJtIM0T+UEQPi8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270483, "uuid": "49e49205-9376-4c6d-a9c5-6a8cc63a5255", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270483, "uuid": "e5c40837-f73d-4c71-a389-e80740696259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270483, "uuid": "07dea7b7-3821-46bf-9159-171f3fd5601c", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adf96d5-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228865, "uuid": "7263b70f-b897-46f2-afaf-49192f074f7f", "comment": "Malware payload (Mirai)", "value": "4e34d298bf20f4fbb3cf8cff28a0ce4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228865, "uuid": "ca035c18-2fa3-4b2a-95d0-20878918a97a", "comment": "Malware payload (Mirai)", "value": "57b273ce848037e473e5b9ca4cb64ae2edf7fc116ce8cceda7d5de0724c23332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228865, "uuid": "8f7a5077-1887-4abc-bc0f-1013cdc4a1fe", "comment": "Malware payload (Mirai)", "value": "45700502af326fb3e65eaf6af4ca9639c8371d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228865, "uuid": "364f38e7-abd9-4318-8d56-5f28b0a9c74d", "comment": "Malware payload (Mirai)", "value": "e044043a5119a28439b341a0096319bb8e76b49e162edf3f3bf26df81f39ed2d9ac79c9196a0c4bcd72c6c35a06a6bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228865, "uuid": "91382f17-3a99-4fc2-960a-9b4750dec2c9", "value": "T1A983C705BF614FB7D85FCC3705B95B09289C960A21E83B367D34D418F25B24F5AE78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228865, "uuid": "651f6bb2-1512-4dc5-9928-35523f82e085", "value": "1536:BLP7dBiwqevwYHMSKq65JPMnc6zk6yRNGhWQfQxvu+7R:BLTdBwevrHxKXJPpWIxvu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228865, "uuid": "921e90b3-2a96-45ec-a391-166bcb50fbaf", "value": 86672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228865, "uuid": "523165ca-f858-4ab5-8f30-527ee597c724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228865, "uuid": "48d13dca-5c86-4e03-9f7a-ea42beef673f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567cbae1-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270492, "uuid": "2194f75d-05a4-44cc-88d0-fb256a94b505", "comment": "Malware payload (Mirai)", "value": "9126f918bc07320dd095e7a2e09c9230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270492, "uuid": "c8d54043-f4e0-429a-9d44-649d14c89b14", "comment": "Malware payload (Mirai)", "value": "58e6374c1f99d4821b591a4127ba2ae5b913f8963d80650008d057b8e38a0d83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270492, "uuid": "a9cf60db-1d5f-4535-b086-2a3aa7169e75", "comment": "Malware payload (Mirai)", "value": "ee65cc1625fcddc6dcbd7a4ae6b01929a87b2490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270492, "uuid": "59f2d62d-f5f7-44e3-b413-eec67527c7a9", "comment": "Malware payload (Mirai)", "value": "ac82e6a9a865b6e8129acfeea5b56e524eb25e3404018650f87fabd2c13351a0d7ae2e9de83f0950e216efb5ec606c7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270492, "uuid": "3204f6f1-ad51-41dd-be2c-d2246e553dd6", "value": "T14AD34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270492, "uuid": "a9e5fcb2-682f-43cf-a5d3-97a5fd8b5362", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTmHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CgHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270492, "uuid": "075a9787-3605-46b7-90e0-cbf74125d22d", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270492, "uuid": "adce8546-7171-4d8b-94c7-8945b756d284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270492, "uuid": "bf97f137-200c-4718-9db1-e9ee7778b2e4", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08ce3d8-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226807, "uuid": "3ca7cbd8-6f60-4baf-8a1c-f61f08a151c2", "comment": "Malware payload (Mirai)", "value": "760d101b4344f92f09082385f56891e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226807, "uuid": "cc5ce8c7-ec92-4680-bbcc-a296493854c9", "comment": "Malware payload (Mirai)", "value": "5910e4cd239cc4ee8630a4341406fb8f34e7be5eaf1cdf99298b55125ddbc4c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226807, "uuid": "3471a5a3-1e41-4c43-9733-955013e4ef4a", "comment": "Malware payload (Mirai)", "value": "2770b55f2a49f32f19fca6a6b3c2a4dcc6df68ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226807, "uuid": "01a21f2c-2e59-4758-8d58-9cd059a26741", "comment": "Malware payload (Mirai)", "value": "4f41b968ce5d1bc7a6dffc965200538bfd236e20d7c5dd85db565ffdc2f1401a2f78b7d6c0dc1d224fc485187f96a275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226807, "uuid": "0c1bb2b7-4c8e-44c1-a044-ce99ce68b3ef", "value": "T1BAC36C87E643F4B0D85A0075225AA3798935E9722022DD5BF7E83F31ECB6F129A1533D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226807, "uuid": "cd2d5a66-d75f-43e0-9a5c-75cc98af98ef", "value": "1536:AdSp4Dlm7X6HwA+mCWCyZ3GA1apF9NqvqFHyUYg3MYqNCiGCUA31Ezwo74mytM8C:AxD0vyFxvwHyUY4MYqEihuFlVxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226807, "uuid": "d52e339e-20bb-4eee-9c80-a3acb6e38e67", "value": 119544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226807, "uuid": "aba9115c-7057-44b1-8b13-9006d8d3b788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226807, "uuid": "e701ed5f-da26-4232-8caf-b9ee85f0a6f2", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb849ee4-e6e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251871, "uuid": "7e6b67c1-b721-47bd-b73a-f787b06e62a2", "comment": "Malware payload (Mirai)", "value": "8ce68fae1c6f5e4a15ad7b944f77e5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251871, "uuid": "2f6c808b-f669-40cc-a139-274f881a9764", "comment": "Malware payload (Mirai)", "value": "59735eb9aa8ac61a79575a45f54123b882fff76bf4fe7c1f9346dadd106adde0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251871, "uuid": "8eadfc08-95f4-408c-ba7a-7bbd80774f6e", "comment": "Malware payload (Mirai)", "value": "9e8e78d6954dff9337b86f9d32e44d7fcb2ec8ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251871, "uuid": "5eb0f7a4-58da-44ba-b386-b0bf1b933b4a", "comment": "Malware payload (Mirai)", "value": "174eaa6c16959e14644e856a548e5932ca77ad60dbd0cfd2ef439988cbdcc8b8cf4cb2b491118c6a0694a953af733b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251871, "uuid": "3f5bd988-e83a-4180-a912-337c71625a50", "value": "T1794302F3F487B8699B302C7DB00785C5BBD101B9D1786ED2624BC714A5A2603714E8DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251871, "uuid": "b1536599-1d23-49ac-bea2-a0390d18ab3f", "value": "768:uXOWkueZS150C9D71ig8L/PlJZ9qCXoVZAfdBe2VHo9q3UELBRtoaKO/g2Y7a2pi:7nAH7UgaZ90ZAfdBeqxLBXoaH/aWI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251871, "uuid": "097cf13d-6e07-4f21-a783-25e680683815", "value": 60404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251871, "uuid": "63a3a02e-debe-4835-b4a0-98a9ea46eb2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251871, "uuid": "55d77e18-995a-44df-a388-92aea2ecf47f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ab341-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228314, "uuid": "909864ac-fb46-401d-a45c-99eb990af3c7", "comment": "Malware payload (Mirai)", "value": "d4b615a6f089e468657ef7099dfb7f42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228314, "uuid": "ccbb8acf-c86b-4bc4-84cf-dd7c0b8a7d51", "comment": "Malware payload (Mirai)", "value": "59b27f408aa22919cec22020bd4beab727ee6595ea10b68599439615fa0b302a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228314, "uuid": "c55d17eb-9a5c-4f24-b4f1-1668bd474c67", "comment": "Malware payload (Mirai)", "value": "492ae621f927b11b7b760607301ad741bc194e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228314, "uuid": "1ee4ecb5-257d-4708-b9d9-7b6392d20736", "comment": "Malware payload (Mirai)", "value": "3acc961ffb669408417a8d604715f6f6514b819c50f9c9cfea2b73ddfd569822079f6fce7e6bd75e0a51ab2d4417f9f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228314, "uuid": "805ba999-f70c-4e7d-a232-9f711a31f7b8", "value": "T14B536DD6B405DF7CFC1AE67AC1120A06F524734596830F3BA3AAFC935DB21988D16F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228314, "uuid": "95122404-9e04-416b-bb9a-afe2713fddb4", "value": "1536:iU7mz2NSKOIBdyyb8Waec1qzi8t75pZSbkQlRaDPC:iU7mkyyb4ecmR7sbz6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228314, "uuid": "d58c291b-98c9-49dd-b9a2-8a22b3fee733", "value": 64216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228314, "uuid": "b792e920-548f-4485-8f3f-0e0d686ae504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228314, "uuid": "3fb955d8-02d4-4f58-a014-040329ddf0c9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7582ae4d-e6f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767261954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261954, "uuid": "674bb59e-9420-4855-935e-4849dcc3aa4b", "comment": "Malware payload (Mirai)", "value": "374a041692549fef584f642261a5ad41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261954, "uuid": "86030728-01aa-4f67-99c2-fe70358a7817", "comment": "Malware payload (Mirai)", "value": "59c52e9ec13aa8f1b48f28bf5a3ddf0d58b8ca2e0cb8a596a30557a535ba4cab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261954, "uuid": "dda11d49-3f85-44b3-8f9f-f02722df9ff4", "comment": "Malware payload (Mirai)", "value": "54215fa95a84220957c8e35231268f136f465748", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261954, "uuid": "e6876222-9e1d-41f8-82ed-77ba8670b2fa", "comment": "Malware payload (Mirai)", "value": "cd1682ecf7c0600e7cabcac2971969da2ec4315b0d3e74647f342894dba81227e6e4ac912eed882c66d03267d6bfcee0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261954, "uuid": "5a86b4d2-1d32-4799-9b64-e752527e48cb", "value": "T1C6011EEB41BA9922C79C8D8830AA88386544D6D53EB28FCCDC5C44B16DC7919B166F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261954, "uuid": "068173e7-32c3-46c3-9954-451bfc24cc53", "value": "12:dUlxqU9UneKlCEU9UTiKl2EU9U7dKAU9U5U9Um9qU9UzFG10qU9Uw1U9Uk7IAU9T:ix7ilC5/KlQbl3d5nQMGrHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261954, "uuid": "ba544421-f22e-4348-94e3-f9e88290b19b", "value": 751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261954, "uuid": "9d358a44-b1be-4515-8a80-dbe957c70d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261954, "uuid": "f72bb707-e51b-4c2c-a490-02af246fc272", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46627e0-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228129, "uuid": "c231e695-a466-462a-b735-db91889380de", "comment": "Malware payload (Mirai)", "value": "544f5ac2735a8514a625a2cd442f4c7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228129, "uuid": "1dac67f9-15ac-413e-ad68-f47f205956f0", "comment": "Malware payload (Mirai)", "value": "59e9356d6dcd9f238ea42f475b8dc1b0bdce7043156cc9c6d075be5f8d00211f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228129, "uuid": "b86fc6a7-8907-4ba3-a47b-efaaf4a56e45", "comment": "Malware payload (Mirai)", "value": "d81d8a44e03bb6c250183826343999b8f2c682e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228129, "uuid": "c8877106-6f07-4675-acce-f176bef57f27", "comment": "Malware payload (Mirai)", "value": "147a776bba3b92c83eb1c1a8f425e30164a37e7ddf8a07fb8c4d6d2a8eff36d60faaed58afc09e110ee31b2b59279d18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228129, "uuid": "6d5350eb-78ed-4006-aa3a-f07da37c9fb8", "value": "T1A2A1A4A110650DF2DF4ACE42AAB58F0A35C85B842895BE48DEF67996D2CFFC63403DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228129, "uuid": "90f7ee41-aeaf-4bbd-9c83-60e821a7dad6", "value": "96:rCOklqkCD9+FtCMq38SCdfcrPClH0zHCSAhugCm8tiMCdfcrsGCc6HsiCXZK5JC+:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228129, "uuid": "b89bd72e-9133-4acf-a5bb-4cd8aee0e50c", "value": 5027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228129, "uuid": "7a53edd9-d117-4379-88ee-4e394968a4bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228129, "uuid": "49a141e6-2494-4691-a453-2702a703f4fb", "value": "tol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa044b6-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292403, "uuid": "37cf0ce2-a571-4532-87d9-e369bcf37ad9", "comment": "Malware payload (Mirai)", "value": "8a112a087833a116612c61ae3044cf08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292403, "uuid": "01c3a792-82a7-4dd9-954f-03a8dd0e0ecf", "comment": "Malware payload (Mirai)", "value": "5aee4f4a3c61b1e513d1e111b0653cd8d1c0e8adadf4b38c2eeba1c163ad3f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292403, "uuid": "9f7e3272-f809-4a06-ac66-afcae63a4458", "comment": "Malware payload (Mirai)", "value": "3f80530990fa122d9222d42c0bf75ab32f4d3ccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292403, "uuid": "87464269-942b-4d3f-b335-ae93966e30c9", "comment": "Malware payload (Mirai)", "value": "e1b77bf7ad573ec1936095a3f68df2ec43e13254ea14253227366c3b70ba247df149a06343005380967469643843be19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292403, "uuid": "6f48abe1-fd87-4fa1-8554-57203390f2d5", "value": "T151145C02771C0947E2562EF0263F27D183EFC9A124E4FA45750F9B8A82B5E371589EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292403, "uuid": "eb8b0b3f-456c-403f-bd2f-bac5333dbaf4", "value": "3072:pAluZuV6SmAs5xOY97ukJE+Kpw6hh1d4MB:elRcAsxj97ukJfKL4MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292403, "uuid": "f3b54321-5c88-45aa-a08b-597533ef1dd6", "value": 200896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292403, "uuid": "80a373b8-2ee4-4c2d-b6ee-d4d1a278826d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292403, "uuid": "e8742c7d-29f9-4f12-b2f4-03bc3ee159dd", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c980a-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295444, "uuid": "7536cac9-c346-430e-bdaf-9b5272b88e4d", "comment": "Malware payload (Mirai)", "value": "7700bb48bfdf0e872060c5c3ce8b7183", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295444, "uuid": "c01b79e0-7755-4ec9-bc86-bdc0036fcf32", "comment": "Malware payload (Mirai)", "value": "5b1baa0ec307a23323765787b2b481cfc4758b777914731b6e37379c11ed17e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295444, "uuid": "6bbd5186-4453-433d-959e-0cc6bc7dbcd3", "comment": "Malware payload (Mirai)", "value": "dc77e8dca47b7b662b8c779c01bde9ba5bb8b0ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295444, "uuid": "1437b740-1d66-4c0b-8676-06660e938f3a", "comment": "Malware payload (Mirai)", "value": "0b3cef2f37954b62545898d8c0d7ab0b2685f0209243af1a7c9f780b5895da93f3a47174b65acf96d8cebc0318922631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295444, "uuid": "761a3d3e-b336-4417-9870-5cde1fd9c794", "value": "T16273AF73E92ABE94D2994574F4B19EB85F63A80181472FBB095DC2798043EACF2153F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295444, "uuid": "d3d4efe9-55fb-4950-b625-1ae4346bd2a5", "value": "1536:tzwtyVgF0C9Ocujr3mi13jKCcjv7UDZ77+Cp2dE1lXf:tztg6C9Fa3DGC8uZ77+xdaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295444, "uuid": "7e4f1673-ed10-4e15-97fd-b62c13755f79", "value": 75212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295444, "uuid": "e93d8769-27ca-4651-8f6f-b6e0b961a432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295444, "uuid": "a8000c0d-1aa9-45e8-b005-ca60aea50f57", "value": "goon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e510db-e746-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767294895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294895, "uuid": "155e7648-6886-4bda-8026-0353108745ea", "comment": "Malware payload", "value": "f5e3bce1449950def58df4bc0fe0d5a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294895, "uuid": "be9369c1-ab3c-4281-b0a2-0ee4ff12fcd5", "comment": "Malware payload", "value": "5b1fc4f679e0d623a085833708a6d288c7f9b2310ee0bdedc6104a274ff95fe7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294895, "uuid": "985268c8-9052-4332-9724-a5a9815a3f62", "comment": "Malware payload", "value": "ce78059f2e4bfe717cbc9fa9303f09b61d61b201", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294895, "uuid": "84676b15-18ab-472d-9350-18a102773904", "comment": "Malware payload", "value": "ad30656d2a1d6353d7e662de212155c65c6a627f65c24884030e5509e71d27a1a206ce305be844ad3a672e313070a6e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294895, "uuid": "12b64ab7-5b96-4fce-a046-7308407e68a4", "value": "T1024104DE2491B1B63A9DCF44F2710E39A40FE2C131C5DD98EA4A186349AE60A313AB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294895, "uuid": "0938322b-77ff-4a79-8d52-162e512c201a", "value": "48:boGGMpzaU+odcO9PDY6iGq6bQaMZ79ecr+PsN6iDv6El/ZAat/0:kz8+U+odb9bYCq6bQaMZ79eE+ENHv6E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294895, "uuid": "b589f637-0e4a-4f54-a485-164937fe3baa", "value": 2160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294895, "uuid": "382654e5-3431-4bda-827a-b702251526d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294895, "uuid": "efad6c89-bc0f-4a07-bcb0-a932fa57195f", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58390a3f-e6fd-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767263622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263622, "uuid": "0e0a2c0c-e0f0-4db8-b769-c29cddc480ce", "comment": "Malware payload (AsyncRAT)", "value": "d13c5cb992ec8e55f805ed71994cd973", "object_relation": "md5", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263622, "uuid": "b8021463-3c82-437f-920c-b6e3941ffcb9", "comment": "Malware payload (AsyncRAT)", "value": "5b511477942e78f0b4ccd248a31aae2cf70453da1ead4edf5ee630af97cbae90", "object_relation": "sha256", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263622, "uuid": "753ba03d-0cce-4e5c-8306-2dd6197eeb9a", "comment": "Malware payload (AsyncRAT)", "value": "3d7b54ec87d3c46c66922bcdc52348ca5cce2298", "object_relation": "sha1", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263622, "uuid": "bfc86869-5b1e-4085-b22e-1b5a565a011c", "comment": "Malware payload (AsyncRAT)", "value": "82cb0e118be4627994164ad6900f3c41d6d6dedb854c399ddf6f80c8cd23c7cf103dc13e4fc5a46c9ec9d1cb677ff0ca", "object_relation": "sha3-384", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263622, "uuid": "2933fef6-843b-429e-9332-994c47279cfd", "value": "T154F36C1D6F8AB49BE42C1EF558A6E6C1073CEF55F4E2579C24E8AE3CB792474C500BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263622, "uuid": "6926e6ec-50ea-46d3-981a-5832fd8dbb10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263622, "uuid": "720bcf2d-5be2-4376-b7c5-af2d479e26ed", "value": "3072:f1MFrFO9KEOM4RUGKXs+S++7KFSbxeY+qDDrM3:finO9fGqStKEbxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767263622, "uuid": "4cec152d-1216-410f-84c1-e4eda3eca5a0", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767263622, "uuid": "03e3788a-68a3-4b2d-9084-ccf3d17d5947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263622, "uuid": "ce15d4fd-c38f-452a-9ce3-27d8563867cf", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c368605-e732-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767286473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286473, "uuid": "d963b848-1776-4fff-bf3c-7d29cf212c43", "comment": "Malware payload (AsyncRAT)", "value": "938b1853a6b4543fdd7c347ddef37716", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286473, "uuid": "1072a119-09d7-4ad5-a6db-9f6f382bdc6f", "comment": "Malware payload (AsyncRAT)", "value": "5b79bd5cf7fa833dac927c19e31ad8956f951fa6abfada53094f5e99988adf8a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286473, "uuid": "999bcd07-6e87-4dce-8fb4-aa2f366e6432", "comment": "Malware payload (AsyncRAT)", "value": "f21d5cf9dd7a4a49819b8a99803e8cd1f4d3fc8d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286473, "uuid": "1e96d8be-c496-4945-8f66-f70671a99198", "comment": "Malware payload (AsyncRAT)", "value": "132096ea4a03707bcede09e44d7435cd4f97b54a77d5802710473da38088296740664764e9244747bad9b063d45977b9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286473, "uuid": "7a27d379-0507-4e09-8629-8602f93553c6", "value": "T107535B013798C965E2BD4AB4ACF2950106B1D9772116CA5E7CC404DFABAEFC64A133FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286473, "uuid": "18b3a06b-b9b5-45e3-aa3e-3c601419fabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286473, "uuid": "cd09fc16-614a-43ba-9f6e-0f08fdf850dc", "value": "1536:bPwihvZ8LxvjTS0+hGbbkUB0VGnMuVclN:zlvZ8LpjTSjhGbbkSMUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286473, "uuid": "613b736e-a18d-4fe5-be67-803064039bf1", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286473, "uuid": "0cfb185e-147f-4e33-94a7-030f5b57afe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286473, "uuid": "97a1b5db-27ba-41d7-aca2-40d84ffd0dfd", "value": "PraetorianNetworkGuardian.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a79e67-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295451, "uuid": "08c31b8f-e034-4cd5-af8e-63d699cc10d9", "comment": "Malware payload (Mirai)", "value": "52eecb19a4f3c611a8d922750cbb394d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295451, "uuid": "55d4d60a-e29c-4445-a834-da0e834b024f", "comment": "Malware payload (Mirai)", "value": "5bd51ffa825cbfde3500aa58c5ef3edbf54365514642b6d16277d4736d1564e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295451, "uuid": "13fb2b5f-4eed-44b2-bf07-4eb331a4d993", "comment": "Malware payload (Mirai)", "value": "2e8f213f544940d159742b55ae3b3159489c73b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295451, "uuid": "40cec351-456f-4964-ba4f-377ebcca7b9b", "comment": "Malware payload (Mirai)", "value": "aedc6da89c20eeb54e843d60d024050fa3348b67d3382b6933bbb6680f52c1f4c332a33e6f22244f70885d54f2b2a569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295451, "uuid": "1b2634f9-21ce-4d66-924c-bfaa9ed66564", "value": "T129043B46DA414B13C0D227BAFADF424533239B64D3EB33069928AFB43F8679E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295451, "uuid": "7d600f08-e2c5-44f2-a24d-c25dfcebab2a", "value": "3072:CjyuOqVVhO3nOafcNVXZGGLaflbBVWeVxz7foHI0Jj1FuHrPmM/9wXD9Miqolxc:Cjyu8XJfcNfrLaflbBV3xz7p0NruHrOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295451, "uuid": "0545e477-1052-4d26-9abb-4abd1552162a", "value": 174850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295451, "uuid": "de8610a8-ef7e-4b27-9d5e-678f1cffdb4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295451, "uuid": "05370d9c-dc72-4f10-a669-62549640b094", "value": "goon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aedd51b-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226637, "uuid": "e018ede0-f8fe-466e-bc59-a87987883e6e", "comment": "Malware payload (Mirai)", "value": "830bd446f2659867f483bce9093237c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226637, "uuid": "d089f3ba-413d-4a10-83fb-d34f12768c08", "comment": "Malware payload (Mirai)", "value": "5d1bedc5ca515116aa6b8471d3f8db976fa53a73f1cca89043e2525e5e157fe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226637, "uuid": "63d07b65-a1e6-49cd-a72d-c39e5c9abbe1", "comment": "Malware payload (Mirai)", "value": "d49d448138fdb14886f2ab55bcb510ff63d76779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226637, "uuid": "d609ad16-1c1d-4c6d-af02-b7a69bc65cb6", "comment": "Malware payload (Mirai)", "value": "ff2304de7c5a2ae96b65910792e1011be02ac253181247a3c78a7bbd927ef67b4ecf165848666c1e3d895b53d96243dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226637, "uuid": "4d3bcfb3-1b91-4124-a3b7-4ff39333d896", "value": "T1FA43974A3E229FAEF76C873587778B20D79423D627E08684D6ACF8055E7030DA45FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226637, "uuid": "4c35bbe8-32bd-43c1-b178-136c6281c2c1", "value": "1536:w3iwkGbWUDfxymSTpYBizzVabbfMzf2FzffgPjX7wSVXg4Bu+7RW:fhTecfEUjLwSVnBu+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226637, "uuid": "67d1ec03-e170-449a-9d39-4694c1ba51a4", "value": 58208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226637, "uuid": "a4df5986-b8e2-4bb2-9283-0e5bc90053de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226637, "uuid": "ed7e9478-07ab-452c-85a4-bcff86256604", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d1da1-e759-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767303051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303051, "uuid": "63f318ce-14b8-4a7d-8841-2d865945b6ba", "comment": "Malware payload", "value": "1c5c0a9542cec959101751754b1e4593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303051, "uuid": "a9356696-0b54-4861-a5f3-d2a464a45f89", "comment": "Malware payload", "value": "5d2e29122a9821c7cd25aff671cfc30e35cd014b3516157a1c6d9d484933403c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303051, "uuid": "70be4ea9-aa1b-431b-bbd5-d3473f9ed250", "comment": "Malware payload", "value": "b722aa369a9dc0014679df76b3420ad0a05c1652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303051, "uuid": "2f4067ad-0e78-40f7-8a12-12fbd8ce8307", "comment": "Malware payload", "value": "31eb749b28c7a3b0577ac2a56ea2400d9a767849a3f2d5a78a5fe756d3c6a0d167e9d923de8c6c4e4ace5483f4e91e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303051, "uuid": "0d3b66f4-f5a0-41a0-9249-edd71024cbf3", "value": "T1E6038D526BF6CFB3D13003B302761684A33987BF7BA2E65D704F099E6F656615392B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303051, "uuid": "1dee5194-832c-498c-8203-e8442f58d65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303051, "uuid": "0bd6d915-a3c7-43cb-94c6-84b0d1ee4867", "value": "768:E/KNoJxTRh53NsH0hWVD2NZgE3FUQa53NsH0hWVD2NZgE3FUYZtYcFtVc6K:EkoJV5d/hsiZBFDa5d/hsiZBFDZtVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767303051, "uuid": "45dd4aad-971d-48c6-af79-071e872029cd", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767303051, "uuid": "cf991151-462e-4a7b-8758-31f3d3edfe7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303051, "uuid": "ff954686-9953-4b41-9e2a-88aa0293040c", "value": "MakuYan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820fcc66-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767252955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252955, "uuid": "d3e575d9-df1d-4dd5-8148-ce9cd45c4333", "comment": "Malware payload (Mirai)", "value": "820e0420b0aa169d546e3075eab98543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252955, "uuid": "a77f2ce5-1bc0-4b0c-af99-c904a671572c", "comment": "Malware payload (Mirai)", "value": "5d4e5eba46e6f90c22cebbafe3e1b082a2d87a4ef0170b6eb4848101dfcd398c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252955, "uuid": "f9495089-c54e-472e-9975-fe7a35f2d4d1", "comment": "Malware payload (Mirai)", "value": "8b182e6bb88e770ab6d9f52066ebeee3695c6ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252955, "uuid": "8ef65ef4-4efb-48bb-9004-3983423bed9e", "comment": "Malware payload (Mirai)", "value": "9b5dd2e376184e0c1928ae3ef7c718e7468f8729c4bd36128583e333bfce53218ff775b76ab8c75c5ff094571d19d3d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252955, "uuid": "3a6a7a9c-546f-4482-8d0c-89201361bf92", "value": "T1A7F2E12190F7BDD048340A30E65E4AC567D22BBAF6B87765996A72FC398644B1371283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252955, "uuid": "cf46d379-afce-49d6-bc1b-6b208a1a96ac", "value": "768:mo4rk1U6ZzYnRPwAObLZnI+tvMWv/7/BvdQ3ZWs3UozQ:74aU5RlObLZnRtUI/BsRzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252955, "uuid": "3d289cfe-4182-47fa-aa13-f335eccf4b98", "value": 35420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252955, "uuid": "453d5286-aed6-4e9c-bc75-3770363a140f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252955, "uuid": "3f3c8ba3-563f-40c2-a2fa-36de1baf3bc4", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133d402c-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272097, "uuid": "5018c57d-63fb-4051-8917-8a24b22fc493", "comment": "Malware payload (Mirai)", "value": "8ad45cc92326188a02364baee85fe510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272097, "uuid": "3d6257d9-055a-41d4-a844-6d9402e291f3", "comment": "Malware payload (Mirai)", "value": "5dcb0c03379edeba229f7d7a92661b58972a04526575941890403e4daebf9036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272097, "uuid": "3b8509bd-0158-4da2-b7d7-7a48f87ef1af", "comment": "Malware payload (Mirai)", "value": "551ae7d51526fd54247d72c9642251980c32e445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272097, "uuid": "b2dbeb89-4b32-403d-8a20-e0cd853b35c0", "comment": "Malware payload (Mirai)", "value": "77b2854507a6909c15c9c4ee16929d7790d323c7ecc72e939990650b906ee1dae0dafc7268052886200db598376ff48d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272097, "uuid": "5e000222-4d16-4e49-8d1c-2e704d1f90bd", "value": "T1A0A312350D6B2956F20AB3F9415F2705B3C755CFE1A2CFB9D2C0221F4EAA3543954B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272097, "uuid": "c208b77d-6587-4ba8-8f0f-427b4b9707cb", "value": "3072:mqYu/3wcuzb3hH0SA6DFSIJH/CLLw+5FVEU0aOI:tR3wvzjhxzzfC4+5MDhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272097, "uuid": "eb24a824-3fb1-46b9-b439-cdf7adbda1e5", "value": 98720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272097, "uuid": "4cad11ef-751e-4806-8aca-50fb9117f7fc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272097, "uuid": "ae2deb6d-bd0a-449d-8e26-3ea279fdd582", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cb30ff-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270490, "uuid": "b48612f1-5f03-42b2-aaa2-646e5aadaf7e", "comment": "Malware payload (Mirai)", "value": "43f93b383bb1e8924e89ee8fd1237876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270490, "uuid": "99f5017c-2bfd-4ebc-85ef-b93b5b3e22c0", "comment": "Malware payload (Mirai)", "value": "5f11e0c2264188314aaf029ac5751e72a69d28947b51b720d7c1a2291ef19cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270490, "uuid": "2af04528-ca87-4369-a004-00f660a33430", "comment": "Malware payload (Mirai)", "value": "22b427a0c3e32eb9362251ea4d2ffb1349f6fcd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270490, "uuid": "011a6533-b602-40ae-9b8d-ccfc21740e34", "comment": "Malware payload (Mirai)", "value": "9ca3d5b243ea0b8f1e2ce98c2baf57a2d9952fb5b97d956bb1a8b47b734d79d11f3d6afb38c5ff417774978bc2888c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270490, "uuid": "f79cc927-dc42-4133-932d-c4b828aae2a2", "value": "T1DD436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270490, "uuid": "13be27a8-c696-495a-9c90-e87359bf4962", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/m:CuOoQAqRU6ECeU6tSbXm5PX5IfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270490, "uuid": "d50ce241-5870-43c3-a77c-822c3e5710bd", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270490, "uuid": "03af8ee5-df96-4291-b866-4d98288578bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270490, "uuid": "6688ea40-2be6-4680-8e4b-8ac8d9790b1e", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6f11ba-e749-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767296275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296275, "uuid": "2ee83c31-eaa7-42a0-80e7-f103cd19c061", "comment": "Malware payload", "value": "15d490ec74f027322b44706154c3aad0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296275, "uuid": "37b95577-858f-4a65-afa1-276b38320dde", "comment": "Malware payload", "value": "5f34caddcab053c963381d5142691633a4432d79f9b1b77346fac698cc3b26f7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296275, "uuid": "0042cecc-33e2-4693-84c5-d8103e6e57d5", "comment": "Malware payload", "value": "f210336e8fa0260ec7da30d931fb64ea46998b88", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296275, "uuid": "d7ff7146-4cd9-4c41-b5ea-aa8c85d077cb", "comment": "Malware payload", "value": "54d8e61d957018a7e6139e5d307c62b27c88da9edb4ef94907b1d233d2a23e5269667829b54d938d6ae121736a02de57", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296275, "uuid": "a154d097-4a80-4c9b-ab19-958afa5963fe", "value": "T152B47C137D80843ADAB90E76993A97719F3DBD245B20855B6388B50DDEF00C06B77BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296275, "uuid": "517676cc-fcb4-491e-8d8d-cafcef9c2402", "value": "6144:lu/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkaFciG5p2rrKU:M+8jOZy2KsGU6a4Ks41x5Vkicif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767296275, "uuid": "27993e72-c3e5-409c-8923-000a76e557c9", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767296275, "uuid": "34d4014d-b1f7-4249-b237-58c9d51ba915", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296275, "uuid": "69e6369a-d91d-4433-90a8-debb1df757dd", "value": "49d3bb4b5f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c2504e-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767280157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280157, "uuid": "632827e4-18cb-42c8-8a84-a165af98da41", "comment": "Malware payload (SalatStealer)", "value": "967883aca8963f47672f2ef0245a9b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280157, "uuid": "5def360e-f8a3-4b0f-b201-914eaaba4342", "comment": "Malware payload (SalatStealer)", "value": "5ff7de2d76e97bd69965d3d7870554e2ff2b466bde70c01ddf2d5c005c20f4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280157, "uuid": "94626b10-82c5-4032-8e22-bbd786fc47bc", "comment": "Malware payload (SalatStealer)", "value": "2b22e3cf426ac6da057783e478a4699c0c01c06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280157, "uuid": "f8b64863-d8e1-433f-9645-3fbe83b961ba", "comment": "Malware payload (SalatStealer)", "value": "8df6865691945b2f48ccf423de18c6c2541190d3657f7b9799aaa1b87c4ff0becbc2bb528d46e95c8e63e00cdf81907e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280157, "uuid": "57469b28-b56a-4105-a8d2-1db8139323dc", "value": "T145C65B51FA8B54F6E9031831809BB23F23315E048B28DBDBFB547B6EFC77681196A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280157, "uuid": "14fc4e0c-ac55-4d7e-b19a-ba9deba690f4", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280157, "uuid": "761f7599-54bf-4b31-b0f0-14349ee0dc06", "value": "49152:huUxNJapoRTq5eVYtPwHZZxM43EgdH3jyziO+sn8KK7UN13XE5z0xTVvPKBSqWYG:wCNoeaPK/zZVcWKJOY0paS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280157, "uuid": "3a2a536e-2bc7-401c-9498-3ec7e246ef02", "value": 11656192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280157, "uuid": "e753558b-7ec9-486a-a0b4-837a68ae0faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280157, "uuid": "161d5355-c1ab-41b0-893f-c80fa95da81a", "value": "CHAOSPHERE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bf2a8a-e6e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253846, "uuid": "259345b3-61c6-4298-a2bc-06048e7cb730", "comment": "Malware payload (Mirai)", "value": "5a6ac6947dd8321fee2d278486183ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253846, "uuid": "a7ecff97-6a9c-47ad-8dca-12665e3426aa", "comment": "Malware payload (Mirai)", "value": "610e725bdc1aa22190851253b093ffce34f84959762ef617efb46154cbe536f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253846, "uuid": "53c98cf0-3da8-4ce8-b370-c809f725e5d7", "comment": "Malware payload (Mirai)", "value": "b5027cf6e3ffaa7b03dc9a40b1fab787143f243c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253846, "uuid": "2bfe055d-ff95-4868-8b0b-b8229eb5bada", "comment": "Malware payload (Mirai)", "value": "3396c7d28135c23e7a0ad9028bbf00d7b0b40fc031db959d30afb2260c0c2a4452f3e60827233409a5b399030cd5c935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253846, "uuid": "c79f7c36-5a18-4d51-8f07-323bbc7d9d7d", "value": "T17D42D0921753328AE221DF7D3B9C340B905C993331799B107A55D60BD86E72808BD7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253846, "uuid": "3f2789a6-0a50-42bb-b299-b7cb1e02fdbd", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvW:yb2eX3zAKuiNPZRwwqdvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253846, "uuid": "ff686267-536b-4435-befd-c54ef2bab315", "value": 13132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253846, "uuid": "316e1c40-e2f2-4799-9dbc-01b7103fd2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253846, "uuid": "8758da0b-59e6-4bdd-8713-0e63a99fcf06", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd34daf-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767227767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227767, "uuid": "bd59beaa-cc6f-4e7b-900b-cb798be8f245", "comment": "Malware payload", "value": "8a23f4955f5d0a38035773fdb858e8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227767, "uuid": "01d41f8a-6b7a-4f4b-9ab7-9998b531137b", "comment": "Malware payload", "value": "6341171cce9eae537cb8302b49ebe6068718968be63e34a3329d0ca9d52a4096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227767, "uuid": "229a1c09-13f5-4646-a941-656fe3a8704a", "comment": "Malware payload", "value": "42cc05b1c7cc368c8d5c8dc4d46078c3209fc88b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227767, "uuid": "b5f7c779-5845-48d6-9df2-6b4f7bd83168", "comment": "Malware payload", "value": "c1d8fd5f47e53040d491102d7bd53fca1fa45f3203a7913be387186db965915f597578753e8faeb65d8132a9a0170796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227767, "uuid": "354934b2-062d-49d9-a03b-1c6ac69ad9e1", "value": "T19BF3731EA9108F7FF22CC33547F3CA65A66533D723E3E646D19CD5201E6838A582BB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227767, "uuid": "89a5b207-2cad-4cd8-8f7d-215e1d5270d2", "value": "3072:5Mn4r4xHkZF0PrZBz3idI7A345ZczmBr+Emp6:E4r4Wa1mwA3QaIaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227767, "uuid": "687ec370-4128-4403-896c-b5d19e39b1af", "value": 164592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227767, "uuid": "884f7d59-a4fc-4f76-82e7-d11a3d58161a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227767, "uuid": "cb6170bf-c844-43ca-a3a1-bcc5da175478", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aadee3b-e6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251896, "uuid": "1c3aaa09-1a69-430f-9baa-631fa863b775", "comment": "Malware payload (Mirai)", "value": "3002d0f2e87b47b0697e3999b3aeaef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251896, "uuid": "e47c819d-ae1c-4dde-b0f7-b537e230e2f2", "comment": "Malware payload (Mirai)", "value": "6357aa2d20c74ca213543f0a71b46480814af0d8f93dec87dff9f400477a57c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251896, "uuid": "86d3a575-6373-4551-9b0d-062ead7df33f", "comment": "Malware payload (Mirai)", "value": "7bfae995b177f76f32476470961d65f598480a82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251896, "uuid": "b03f40d5-05da-41b3-a874-e7d14fa0bfae", "comment": "Malware payload (Mirai)", "value": "7a41152bf405f1fcbc68122ef1de56de1b55068074b018178d1baa08fa4b3dfa8d7d2bd7b2df2369b3ae50fd3135f5c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251896, "uuid": "0f74efb7-9c28-4b86-b308-2c44421734dc", "value": "T12BF33B56EA408B13C4D2177AFADF42453323AB64D3DB73059928AFB43F8679E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251896, "uuid": "f1f40131-d596-4d34-bd8d-44df3e188d5c", "value": "3072:mq2koSAuaONVZc3Pxmk9etmzrTSG6OugPTM/90CFILJh/M:mq21uaONVZc3JmkImvTj6Oug7M/90PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251896, "uuid": "e00010ad-d521-4087-8538-a68d143b8b66", "value": 159335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251896, "uuid": "6499a307-fa3a-4762-ad95-3dcf49e8d7da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251896, "uuid": "dc879c02-84f5-42a3-8ba7-8d070c2dc00f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e0c3a7-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292558, "uuid": "5b8f7b4f-bf6a-407e-886d-8d53ccff925d", "comment": "Malware payload (Mirai)", "value": "83ef47592a6ebc257e2689b79375694f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292558, "uuid": "0e05382b-c071-46df-a628-f958df3a979b", "comment": "Malware payload (Mirai)", "value": "63a4002b058575378d0dc5bf01ca9f2398963de003b91c97930eb80425d14614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292558, "uuid": "c27e08c6-9c0b-40a3-adee-dc66826f6f4a", "comment": "Malware payload (Mirai)", "value": "d8f6acaaa557f8f8e1f64e3c29f3b4b6d1f3f92d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292558, "uuid": "f5b36e21-037c-411a-8adf-40fa93638861", "comment": "Malware payload (Mirai)", "value": "83e489028d8fb743a8dbc4b5c28f61e5a4bb6ed8e1cfd18b9a4e8d60a847dfb1f18188885fdcacac3eef2d2eb9cf08f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292558, "uuid": "e78799af-bc10-47ac-9487-34645ac1f8fa", "value": "T11C93F707B9829F01D4D631BAFB9F41493353AFB9E3F931129D24AF9023C69DB0A76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292558, "uuid": "2a38ceec-2536-4c96-9fba-f3eedd861b66", "value": "1536:LvnZQrb0psjc3ri8QEdUOQQaIwGKUetuUalQllKWiIX7hf4Yku635W:KrIyjc3rWBpQa1GKUetmgX7hf4Y6pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292558, "uuid": "e633f204-9d5e-4de3-87da-3d6dfde3ac3e", "value": 91580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292558, "uuid": "d8e422a7-4019-4295-88db-daaf0b15db16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292558, "uuid": "ae391470-a2f4-40e2-bde5-15ccd70ff9e9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8285b0c6-e6e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767255104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255104, "uuid": "69685e90-1fc3-4538-a974-afed55233c4b", "comment": "Malware payload (Mirai)", "value": "8b20ad308d8dea69de6fa1fe67b0f5af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255104, "uuid": "c0a6cf38-54e7-42a1-97d8-4c142b129089", "comment": "Malware payload (Mirai)", "value": "65f2e9db1c16ae211c8bc9507af456fc17007cd50e8e65c6468b3a6399ce1fcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255104, "uuid": "e57bed1f-def6-4878-b222-a4f9474e3d47", "comment": "Malware payload (Mirai)", "value": "5e7b5a929008a584a95aecd30ecb642188ecaf01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255104, "uuid": "7188fba8-07f8-49ef-abdb-7d5ab2b3e8e8", "comment": "Malware payload (Mirai)", "value": "1d1e2a90340edb3e31f1c53865dfdd14b107e508b98346110a874765e5ecf043f15bcc3c7bca1ce93af7eb592d52aa8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255104, "uuid": "d8326125-ec18-4876-ae9c-6811446ef986", "value": "T106F2E17B1A1015E3C72C40B0CEB00F642F650FE53887A8857DEFE79BD50A9A59C4B6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255104, "uuid": "be40b096-05ca-4113-9a45-5bb1de085749", "value": "768:i6pJsQ6qOSZ4BYyrXqPKHoBdGLbrdjR1kNlkx2bJgGlzDpbuR1JAS:i6jka4LoBOdV1alkx2RVJuuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767255104, "uuid": "a677dfbb-e4a6-4609-9499-51fa760c695d", "value": 36860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767255104, "uuid": "f3a9cd4b-6cff-4af3-8af6-2d67f90fc581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255104, "uuid": "8cc0761b-722e-4b06-a52a-f96c2daa7dc2", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a455f25-e736-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767288027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288027, "uuid": "081ba684-3cb8-4732-a2c1-f51dbfca17aa", "comment": "Malware payload", "value": "b2d6d0c7bc1ac2765e8aaef38f1f5d38", "object_relation": "md5", "Tag": [ { "name": "AzovWiper", "colour": "#3A39E2", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288027, "uuid": "be19eb52-5856-4660-a3f6-967c7558425e", "comment": "Malware payload", "value": "65f962dd4750a62cce15361b3c55ebdfb36c9265d139719a458ce89858ac615c", "object_relation": "sha256", "Tag": [ { "name": "AzovWiper", "colour": "#3A39E2", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288027, "uuid": "503d4ad7-bd5d-4f11-bac6-f73131cca9ee", "comment": "Malware payload", "value": "b335a5d530a878bfe2c31d6926135830268860da", "object_relation": "sha1", "Tag": [ { "name": "AzovWiper", "colour": "#3A39E2", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288027, "uuid": "745a09f8-bf76-4c2e-919b-87bff6e6bb21", "comment": "Malware payload", "value": "0384aac7e7d5428e5a0c1ee3596a4988070f8a53c3dc65a7f0a8cff6281b25614205b3c71b85904fbd0ac7e1c9927b40", "object_relation": "sha3-384", "Tag": [ { "name": "AzovWiper", "colour": "#3A39E2", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288027, "uuid": "9957b189-5ff1-434a-ad48-27bf863016b3", "value": "T1769302A8651739E34B54E8025E779DA14A7F0AD0714613FE2D0AD24FBB70452BF2A4AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288027, "uuid": "f5f623b0-caff-45ed-bce7-cc79af0d9dbe", "value": "1536:7j7Nn5NKI8VLt0iul/NbJ3iAsB/MJqJl6l4MipCs95hiLcV:7FbKIgt0jl/Nl3dsBEYJl6iMipB5k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767288027, "uuid": "3e8d55a5-549b-4ae3-ba1d-81df4ae3694a", "value": 89780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767288027, "uuid": "c71fff07-ace3-40f0-bfc4-f365f612486e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288027, "uuid": "5ae685d2-0ac4-4706-9aa2-a104023c21df", "value": "dbfe9c47a2ce602ae249f6cc78d661c7348ca7fe22bb8060e45d5472b8c9ea64.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e8d8b5-e746-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767294891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294891, "uuid": "3b9822e6-0c44-492a-ac42-62b06b780fe6", "comment": "Malware payload", "value": "a3c51f07a35cc543d04c62582ca9df78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294891, "uuid": "d6531d55-fdc1-4ee6-95c6-34606b9865da", "comment": "Malware payload", "value": "667b9524b62595d4172407c8f0426e83f71cc4d448d4307c5a4bab84032ff9a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294891, "uuid": "1217789c-07b2-4eca-b127-15b9198006ea", "comment": "Malware payload", "value": "3b0639964f77f540c91d7d34c09f919a435eab42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294891, "uuid": "48588813-8c19-420c-a9ba-25822ff8596b", "comment": "Malware payload", "value": "830bd0a207d9a1a965cc72c7075f8d8703dfc8931a65934e7732515ced86f7340da17a0c855185279fbfeaa01fc1e582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294891, "uuid": "c0b69c0d-a0c4-4866-ab98-a085c5ba9131", "value": "T1BF83C509AF600FBBE86FCD3706A81B4235DD650721A83F397578D828F65A54B49E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294891, "uuid": "6c971549-f506-47ee-bcbd-5a1aea5855b0", "value": "1536:ZCD7BC0eARx99jBvuRxfx12aRuh5ZfN8muQQi3O35:M8h0vKT2B5R730", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294891, "uuid": "99a022e7-3e85-42c1-b04f-c4fa2ed87b71", "value": 86088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294891, "uuid": "2ad049c8-a28b-4b5f-a921-717d1228e678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294891, "uuid": "71ea9553-2515-447c-b478-21fda82a0b54", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf7b12f-e730-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767285719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285719, "uuid": "95c7ddf1-bed2-4d8a-a765-ce9ac36a1450", "comment": "Malware payload", "value": "518a9780e5d7af6a26030f77fcd15fe9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285719, "uuid": "caf9f951-5130-4ce6-ae7b-f0101bc347c6", "comment": "Malware payload", "value": "675987664b22d0ad5f4b8062df9c192059baaca6ca1cb09759a87a5e62a06a03", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285719, "uuid": "60230241-8b38-421a-b737-f8a004f5d8e6", "comment": "Malware payload", "value": "026b6ed675ec103088fc760a883ff80b291f4321", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285719, "uuid": "dc9dbe5a-014b-4b44-8f27-fdfdc77f6acc", "comment": "Malware payload", "value": "d667952f66862d92f4619940685c416c58f3ebbec4b2a874330c39618d86caf1384909728fe993627f916e10cf40af2b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285719, "uuid": "45578678-dea9-4da9-87be-e34f0c838729", "value": "T1ECF4B603D213B963F69FE37FA574C7006A30D576C58752D3BB7C2C66ADC21E2588229A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285719, "uuid": "8c55d9aa-8fa1-486a-bcfd-45e6141b1e6c", "value": "6144:j9jTRrbZK0NVapxazsMNXmUe1GLIbi8HklMOXzVX3yCcIEePgcXvMunKBx8cjzOv:j/ZbVapry8H6953/ScyOko5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767285719, "uuid": "1056ab70-2520-4ec6-aef0-c968ae60aefd", "value": 735331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767285719, "uuid": "665140f5-199b-43bc-b802-1e3ee4f2e0b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285719, "uuid": "76f2f19e-c9d8-481f-bed9-86cfd63404b4", "value": "KryptonPlus-dupe-windows-x86-1nomolo22.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802c8789-e744-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294184, "uuid": "86620fc4-b358-4d59-990b-5dbd40567457", "comment": "Malware payload (Mirai)", "value": "5928f2fb20e69c6c5e652e7b2803cf28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294184, "uuid": "16d7d726-d02d-486e-94b7-4fef6dfb9cb6", "comment": "Malware payload (Mirai)", "value": "675f573567f38f101d443afbe66ec33e52a27eb4a9d5db876a85e8276e33ae62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294184, "uuid": "cfa424fe-0f9e-40a8-8b19-39e561fe835d", "comment": "Malware payload (Mirai)", "value": "6f07654ae1a1286fbffacdf97c396ceb1e7a9ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294184, "uuid": "7baeaaaf-3025-42fd-b728-aa8d4d090f0a", "comment": "Malware payload (Mirai)", "value": "07487b07dc5e1e4f18431a2e17c8ca56986c655456678ea241afca3cac0bd53d3d7703f51207edbb6a8a6e44574bd8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294184, "uuid": "3dbfc525-69c2-44c8-a8be-b168b800aeaf", "value": "T1B983028CF9C3EDEF85DD4D3A14A65AB24A64B18273250614827F0C4E5386C39F6C7DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294184, "uuid": "6f3eea1a-46bc-4835-87ae-ae0ebee41171", "value": "1536:CV8sPzQ5OyeLOLZUi8G+Ksi0pWO7Xq1rT/wtQ8k:O8Kk5OyeLaZUiH+Ksi2r8f4a8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294184, "uuid": "03e8ef02-7534-4e04-a41d-192481a8ee18", "value": 80744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294184, "uuid": "fcfbb987-0ade-49cb-8bad-fbba2d464450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294184, "uuid": "0ed96c65-52a8-44b1-8b68-27f60a365066", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6307f77-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233366, "uuid": "c9f09d92-9e24-4ebd-9328-a3b3c900bb8e", "comment": "Malware payload (Mirai)", "value": "2f9cc757c51f966bb784fe6586d82742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233366, "uuid": "fc45bb94-c9c6-468b-a166-4eba5803ef1e", "comment": "Malware payload (Mirai)", "value": "67e30afeff7ada1b9eec8b9cc715daed2283bbc0bb94cadb724dc825a984c5de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233366, "uuid": "595eaf78-992b-46b3-993b-0ba688b9439e", "comment": "Malware payload (Mirai)", "value": "398bff53c0f27cf1057717a35e4080e9a0ab6154", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233366, "uuid": "2a1eb39d-022a-48e2-94e1-0c9719b5e165", "comment": "Malware payload (Mirai)", "value": "a3ea1c8664f796096da3057904babe5f07834030662877e9876ca7832ad948ce304051a04804c7627d17a6c49c74f36e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233366, "uuid": "aeef885e-0654-42ee-8fd9-09b01c666106", "value": "T1FBF33902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233366, "uuid": "fb04ee3a-7883-4f8e-bd1d-ad53ce2a254f", "value": "1536:6W3bmyGKnCcQjYpmtesxgDVT5XVmDKgFi+tk7glvAbR4eTGPN+ErQqZPE2IymQYR:FLm3Iy4mtpxAV/CFiok7nb1EW6hh1X+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233366, "uuid": "dc373264-5549-4e44-8759-4232902eca66", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233366, "uuid": "79457c67-cf93-40b1-b5ec-b6b377dba783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233366, "uuid": "ca8bdd99-6a49-4ff3-89ac-297e3404f584", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5142f5-e733-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767287062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287062, "uuid": "9ef55406-7a80-4e12-86c2-6da8ed390ebe", "comment": "Malware payload", "value": "1bdd2ce28ae87c1c85244636ed7e8d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287062, "uuid": "498faccf-347a-4e31-829d-6fef39e39bca", "comment": "Malware payload", "value": "68bfde8577afd6c39aadff3b0de14c537878b58f7e7b0c88aae3ba6b828d6d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287062, "uuid": "1589abef-6535-4c5a-b25c-dd4e5a9238e4", "comment": "Malware payload", "value": "5022777706a3aad92b0dff2b8d1f8e61d2b3928b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287062, "uuid": "24d31dda-cbc4-421c-b802-ada4c3293e30", "comment": "Malware payload", "value": "cda5727cae8ed1629c14f2a3243e1d4923e055bedd781c42de73b7d1d1d0a77c69fa6d6afcf2cecc293e854557762a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287062, "uuid": "69c9b174-94cc-4a19-95b0-55e814c24e65", "value": "T1C76733A7241540C3C6F9113E802B962589A77931AF84C39FC7BCD6999F7B2F86835E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287062, "uuid": "31d538e0-4fbf-4be5-9c9c-2b3d53f06490", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287062, "uuid": "48b9f0ea-3502-40f0-835e-a71a09f21bea", "value": "786432:YoSIoQlFLbFlUR1O4dcaRvf4K7LiAlbP2XQqF6AufTTD50TBFn:YoCQzLbEW4R4K7Li2bkYTTGTHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287062, "uuid": "8bf34c82-b9c9-4c65-a514-2202a8b9dd91", "value": 29751275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287062, "uuid": "e3deac65-d598-4883-b3dc-50dda8ad7bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287062, "uuid": "dc040c0f-f309-4bef-bfca-927d52a37c47", "value": "Syntex Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563a3016-e6b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767230977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230977, "uuid": "6b02683a-982f-4856-bee2-1992d6451c36", "comment": "Malware payload", "value": "0f746b7aa698be52501c6e286e9e7191", "object_relation": "md5", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230977, "uuid": "7dac85e9-f6ae-46a6-bcc0-7e3d22719b29", "comment": "Malware payload", "value": "691f548c4ce1ccddf286b38dcf89e7911c6ffa44718b8cfa1e059324e2e93cff", "object_relation": "sha256", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230977, "uuid": "2622c87f-547b-43ea-a4d4-4ddfb22b13e6", "comment": "Malware payload", "value": "0fd09e6b8d431718317240d9ba3f48dfd9799ac2", "object_relation": "sha1", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230977, "uuid": "5febed28-0e4b-4188-bc35-90da4c902fb5", "comment": "Malware payload", "value": "467f86818560756f0ff4f7c4c9a4edcbdad37c40eed80b9553d9005e9971e3b94471480b58d4eeeb2733070fa1bf275c", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230977, "uuid": "a4559cdd-8d5e-4850-a87b-c64176546e8b", "value": "T10A95D05933A442ADFEABE177CA13C607D7B178460237861F01A4AB766F337715A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230977, "uuid": "4e6f6b0e-fef2-42e5-a847-dcc1e4f46223", "value": "6c9794990dcbb89d798ebf671bb8138f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230977, "uuid": "0396b594-a6a1-48ac-b0d5-6dcc8803cdb8", "value": "49152:K2EYTb8atv1orq+pEiSDTj1VyvBagKl0TssraA0zyMH0BX7/Au:XXbIrqFnPA0unX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230977, "uuid": "f7629615-df90-4fb8-8f03-b3a80d171f8d", "value": 2016256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230977, "uuid": "20ea4ce6-8129-4f4b-bb6f-278f12915eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230977, "uuid": "ca700cd1-e45f-4642-845a-2ab004e19d77", "value": "XBNrzfxR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bda49f-e6c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767239350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767239350, "uuid": "29633905-421a-4c68-90d3-27c3bdfa3606", "comment": "Malware payload", "value": "56dc84285b82e7c60c267f81b35baa98", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767239350, "uuid": "f1e35ef7-e4ea-4ebe-801e-b61f253f0aa4", "comment": "Malware payload", "value": "69a80f50cdb8342133da5f885c481b310083af2a03903c421de53330b1de604e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767239350, "uuid": "c0bc4e2c-4df7-4e74-a066-8b57e04b6d94", "comment": "Malware payload", "value": "b3697cfbb0fc24c472bb3a3963aaeeec6d42ef31", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767239350, "uuid": "1e89abc1-82e5-4eed-af6e-1ef9cc59091e", "comment": "Malware payload", "value": "f0c80affdc83005ebe6fa638bdabf3be7eaffb19d53e09fab33d573ca1e471c5418440d1387ee768d8cd1fcbae71b7b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767239350, "uuid": "8604c127-c186-4ab1-9802-255932e8dcb6", "value": "T1361126E902D053054C6CEE443A590619D659B780B8B49F7DE8D4847AFDD860B7168FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767239350, "uuid": "7223108a-e188-4d91-8c5a-b6b8c50e88f4", "value": "24:Y+SzANNIKiIRK04PadIFQBMdVXm8k9IhJ6dGau7dMxv:rR0KVmU9eMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767239350, "uuid": "cf21ecfb-03b5-4c43-818c-64e21cba090b", "value": 993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767239350, "uuid": "d701e596-c85a-4d58-90a7-82bafb646f9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767239350, "uuid": "06360363-8324-4be7-bc1f-f0028d1c133e", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dba6e54-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226990, "uuid": "f759b4bc-8bae-48fa-83f6-61fc308436a4", "comment": "Malware payload (Mirai)", "value": "2b6541afba644576687ef9dc64570765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226990, "uuid": "e4a9ef88-237a-409a-b01a-96cdadb18a0a", "comment": "Malware payload (Mirai)", "value": "6a0ce778554378de2c96d740ada85f3fa97993fe688dbe269b4b1d9e438b61df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226990, "uuid": "6ac3cb4a-099e-4abb-9610-7715ab1086ef", "comment": "Malware payload (Mirai)", "value": "0787fbe64487548178c9edda6f4781d06ec34f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226990, "uuid": "891f8714-4a7f-4c8a-8630-bb02a0f4e6c1", "comment": "Malware payload (Mirai)", "value": "a0db9e9dd1feafb9e673f30b4533c42189a2b7291d95c1d1973e4d38155f1ffb8e70ccdc720e05e5e51dc4dc0fa9ba97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226990, "uuid": "0685fb40-01e2-4439-9ee6-72c75d814149", "value": "T197B36C02718094FCC8C5D2B44FAEA11ADA22F46D2275BA5F37D4BF163E4EE503B5E261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226990, "uuid": "ca97085b-1012-4f22-be29-114587ee70a6", "value": "3072:hP+QlCYmbKkIj/Re8gpg266HLiva12jtUe2m3A5lj:h2QLwrY8SS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226990, "uuid": "9952810c-60fb-441b-a244-53eabd64474d", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226990, "uuid": "22f22924-a354-482a-9079-080f18f82050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226990, "uuid": "1b77b171-2f05-4484-879c-a56347dd6536", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b609132-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226262, "uuid": "f424a1a7-2cc4-4392-81a1-eb8cfca1079e", "comment": "Malware payload (Mirai)", "value": "f38937ffa8d7e34c256aa4a5fb825496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226262, "uuid": "f693e4cd-d66d-4677-b1bb-cb7544ff7fdf", "comment": "Malware payload (Mirai)", "value": "6a723606451bad90ad32d966dbc3aac92576faeef65e1f390dc493642551da58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226262, "uuid": "e85b9ebe-16ba-4f98-945b-ee004fd501a0", "comment": "Malware payload (Mirai)", "value": "e9cedd4a50eb822a07d872b284f6a76ec4598d3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226262, "uuid": "8a2f45e0-f8ef-430b-8a05-eb1bfb4b4eca", "comment": "Malware payload (Mirai)", "value": "8714fe32a92255dee2e7204b2148c8bc4db1a16e613a36cbcc28476314ac898ccc2ac4befc20da7767d196775a73216f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226262, "uuid": "d91b85af-ff0c-4dbe-b1e5-b6384bccbc7b", "value": "T12283A60A6E219F6EF768C73587778F31D788379226A1C281D16CF9015E6434EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226262, "uuid": "abd1c4e3-c7b6-4ca4-b095-03a011dd4907", "value": "1536:cQtYoXdSTQZ0W8CEjEyq6pam2PAlULOIPS3k/39t/33opTXe8S5u+7RiZ:bYsddKaL3CjLet5u+8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226262, "uuid": "93a0327f-e19c-4ddd-88c6-03668269da59", "value": 84800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226262, "uuid": "fd3943ae-531a-43c5-87be-56bcc67e900a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226262, "uuid": "21cb7cfc-d5e1-4536-bede-6f345f70f56b", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23679e4e-e730-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767285438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285438, "uuid": "a037e502-94c8-4a16-9df5-b1225d7e7d19", "comment": "Malware payload", "value": "e605b56592b8d6784bea425662b0c7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285438, "uuid": "7d5aae81-81a0-4486-ac57-779c6885ceb3", "comment": "Malware payload", "value": "6aed0532be973d38392d39625f08a371d9734f7a83493d3506bcd14f7820690e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285438, "uuid": "8d655ace-7889-4e55-af97-f288f50da7b3", "comment": "Malware payload", "value": "4ca36f77db108a2b9be2de9175ffd568e8b1de2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285438, "uuid": "35f977da-6577-43f9-84b4-80836b4a7277", "comment": "Malware payload", "value": "db11082b8a879f4a2a43788c884d9394c4d52c08806d00af294742b155e6791cb9360ff814f230a4a2e05327bd4fbb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285438, "uuid": "59dbde34-cfa0-4ae5-a9cb-ea46ed6aab64", "value": "T1A1A58D13F2E940E8E0BED67887669632EA72BC454B34A6DF064072551E77FE05B3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285438, "uuid": "318c10f2-9bcf-4c93-8cef-373635baebd9", "value": "244221361f00795ca74f04b2779490c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285438, "uuid": "1c7c2d24-633d-40c7-b543-d503a3789839", "value": "24576:jcvOn1RC8/05azWu76zsr1UZ6vDSUGbYerOD3RDC+8H4tmGV1Tz0omSRllhc:X1RCK05az/vWvboBW+8HpiflmSRlli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767285438, "uuid": "f4dbd8e0-ec12-4bf4-936c-713b0ebdf1b6", "value": 2139389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767285438, "uuid": "3eb9c701-5b7c-4935-a6f0-36fff8aec202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285438, "uuid": "d15154e3-5e87-45f2-b4bc-aae968bd86d7", "value": "6aed0532be973d38392d39625f08a371d9734f7a83493d3506bcd14f7820690e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c7160e-e748-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "7ae02d95-8d8c-4b7a-9c64-fe8733d8b799", "comment": "Malware payload (Mirai)", "value": "680d57fd8ebbfea6cefb411ebc0e1b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "352620ac-c970-4ba3-9ccd-296a9bf6a3a9", "comment": "Malware payload (Mirai)", "value": "6b07cb03a3ba676a20864baf2123004f0f990f8ef84b48d205c1f5da7bf96551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "43ba1891-3867-4d17-8286-cd95d620daa5", "comment": "Malware payload (Mirai)", "value": "572916e6d0099cdc43c34c0a3d1a1a3b56f7722d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "e5a5fc38-c105-4cfc-bf2d-54808b60b371", "comment": "Malware payload (Mirai)", "value": "52532ea52044b90b2ad53c2f97fa0b17b8ea7ad6bb55b3532f478926d5aa87308d67a4a9726d52e28faf407410a269fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "372be4b0-90b8-493c-9b6d-62d4c8c4edb7", "value": "T18173D84ABF618EBBD86FDD3705AD4A4535CC860722B83B7A7570D428F24A14F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "55c2e017-256c-4b6f-acc1-644280af2d53", "value": "1536:RZQdrOCFKDH5xdOWqF4ZxqYuaTi8rsAaoQvjNTEO6bVR:RZKK1x8F8biE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295987, "uuid": "45b93730-f57d-4ee3-82d8-7f8a9a5749f3", "value": 76652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295987, "uuid": "51d619d4-4f98-485d-bf6f-cf5eb5a4a160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "f39738c2-2b94-49d7-8135-f1e4ec7b94cf", "value": "vv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1771a8-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295870, "uuid": "1d3e4f79-caa5-4239-bad5-721a8cb62de5", "comment": "Malware payload", "value": "fcb37d194089e5e70c347a392e651904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295870, "uuid": "3fe3aa2d-8cf9-4e92-bf51-1468edd1494a", "comment": "Malware payload", "value": "6c6b9785b965f146090e07c56269f81b0d066eab57ea79a705459c797910136f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295870, "uuid": "d696d04c-af4c-4be3-a974-b0e1d94cf1d0", "comment": "Malware payload", "value": "45acd5ba95dc2ad3be32ac1801280d7341598676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295870, "uuid": "2dc73826-a7de-4fa1-925e-017a074a3782", "comment": "Malware payload", "value": "50d624111fcfc1a4f12dd9ede9fea6f6ebbc32f2d7f46de05e00daae03a2b1bcb4ac0f57262ee58e1741766667af2205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295870, "uuid": "3e464fef-f635-43bc-9841-37d473946755", "value": "T10C46D002FBC690B1F893167956BA57BF4E39BA14873484E783D0186B89307D15B3F3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295870, "uuid": "cd5148ce-9d59-40bf-88e6-322623716390", "value": "f21793080cfccd896ff6a756db8d079b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295870, "uuid": "7f8c7fc7-d449-4e46-8106-896296a7b1bb", "value": "98304:CGt7lrC68CekhjTh8rD4evYY2FffktwxTXUgD2/:CklrC68CQAzFXkqXbDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295870, "uuid": "e0041916-dbc9-4964-bc47-d9a26efdf6c6", "value": 5769096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295870, "uuid": "613abf25-30d2-4887-b2ce-d1b0ad37cbf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295870, "uuid": "2266fd0d-d6d2-4d2a-820e-ec0083eb8c31", "value": "DriverTalentXWebSetup_b2222b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ec1af3-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292910, "uuid": "d8e41729-5d06-416d-b1fe-5ff5402601eb", "comment": "Malware payload (Mirai)", "value": "1e2d508214479d785b5722a27e83ea53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292910, "uuid": "c10b5069-b6a6-41a0-9020-1ab986f00bc6", "comment": "Malware payload (Mirai)", "value": "6d1cd873d65d376411e8ceb595a7aa42c98d936f559a9f3fadd668179ede4745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292910, "uuid": "20abd42c-0aac-4b07-b6d6-3cbe994ca3ba", "comment": "Malware payload (Mirai)", "value": "7cc55643acb36ed5e67c1f512cebe4026c6c08d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292910, "uuid": "8078424f-9a9e-49ff-9382-a656cdf9d9a2", "comment": "Malware payload (Mirai)", "value": "ec24556592ec71a19f6a704d08b8860c68fca79d7f13aa12dc0a6e99af16c5975d51f89d9f8fc3fca4b1cf2608e8a215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292910, "uuid": "1a2c819d-942a-4aea-8980-b722a54cc2f3", "value": "T1E7244AC7F800ECBDF84BE6B744534905B530B36254934B377267BD67AC3A1AA0927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292910, "uuid": "853b2e98-a065-4187-8268-ab28b3a85f4b", "value": "3072:VEDy+gUtp2Vr0LbrregoA2eXXkSyXS1PXG0xtaxKhC9/b1VxjbigLybU8uh/FPan:3zUtpBL6goeLyXGPXGethk/btLGf2an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292910, "uuid": "9b2d459a-bc00-4127-82f3-70b51d70d019", "value": 217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292910, "uuid": "2bfbf161-46eb-465c-9145-77fd97a2f4b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292910, "uuid": "e4e735c8-a75b-4a26-afaa-aede31985246", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f84d04-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226259, "uuid": "2e2c274f-3d1e-44ab-a61e-3dd798ee1344", "comment": "Malware payload (Mirai)", "value": "6520b8074d3ed16d1e8567a0fc4fd305", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226259, "uuid": "32d86672-543c-4981-9d0c-0832cfeccf9c", "comment": "Malware payload (Mirai)", "value": "6d27d22a009437d937b0e11d63dc19141fdc95620613544ce5757977b2f8f777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226259, "uuid": "c94f2a97-a964-48bf-8ab9-54452da3ffac", "comment": "Malware payload (Mirai)", "value": "a2c3d2b1640eeb5786e4e50effdacaac27521e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226259, "uuid": "155b734c-d7cd-4e50-8468-ff45ad07b32a", "comment": "Malware payload (Mirai)", "value": "e71083c74e80b8e97d07a92b14a9542f61c4aae70c69602c2c443079102dd53f1ad0a916988b508eb71acac5cfae2588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226259, "uuid": "35299275-3098-48a0-b366-ca4ce6eb7145", "value": "T122132A92E404FD3DE84BEB3AC613490BB570765586910733B377FC939D72298942EE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226259, "uuid": "2da4fea1-628f-4524-b4b4-1e9dd2b2afd0", "value": "768:XEHNQ3CQoH2CwHjzEmExRu4JTxkkupDTDhroYwy5bX8gUGkF2amfJ9srt7aDPlcf:Xi99H2Exc4JTxkHpDT1kqhX8gQF2aaJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226259, "uuid": "b0af362d-678c-4e83-aeca-cdfcf021ab11", "value": 44776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226259, "uuid": "97f2387a-7fcb-4443-bad5-4340b198dcb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226259, "uuid": "54e01ca7-f6ef-4802-bb33-56499961e122", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3dd735-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295437, "uuid": "0c66a47d-f36a-4e7c-b10a-1ec7b2b3bd9c", "comment": "Malware payload (Mirai)", "value": "e830a0d03bfeda326cbcab6836815290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295437, "uuid": "d83949b5-8ba6-4a80-91c2-09d7653911b1", "comment": "Malware payload (Mirai)", "value": "6e31de284320c14b585487524680c08f7953240de03ff579471419d5c3d43235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295437, "uuid": "399359d6-c958-4635-8258-a63b2a575869", "comment": "Malware payload (Mirai)", "value": "6c952728dbea99f9002da357b62dd62c4bccb0cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295437, "uuid": "eaf26bf7-a282-45e7-b1be-265e62032aee", "comment": "Malware payload (Mirai)", "value": "1147e84ef552f3bb3da9596f62cf0617ba2dd27abac4be56137d3365c221a180f44a80bf2054ead96f5a2e659dd9ac07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295437, "uuid": "1eb4b9d5-6cba-46de-b07e-444b2820b6e2", "value": "T1C3B3E606BF650EFBDCAFCD3346E9074525CC651A22B93B3A7934C928B54B14B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295437, "uuid": "acbf49ef-df0a-4788-b780-6dec5cd2b84f", "value": "1536:kELAT255rTzB1MpF6KInUgXmJKFkgz29Th/TZ5WoVNMrK3FqfxN+RZ:kna55r50FBJK+gzITh7qE7RZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295437, "uuid": "48e015c2-be39-4e6b-b3ea-147dc337508e", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295437, "uuid": "8008ba5d-8079-444d-9e1e-be67227a20d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295437, "uuid": "f7285ec2-2faa-49af-92c3-a8daf285dad9", "value": "goon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aac26ef-e725-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767280726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280726, "uuid": "991798a6-a6ef-415e-b61c-235a3196e45e", "comment": "Malware payload (Mirai)", "value": "3f2a586b7322ce5c614e9872b760c092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280726, "uuid": "772da271-a6e2-4f2c-b265-ea78b66d1ca0", "comment": "Malware payload (Mirai)", "value": "6e5c5599424c8fde5068fb78379c48d30adcba388791ee56922e633ef34dc6a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280726, "uuid": "4ac3cfed-085b-4753-b37d-2b217f8d05cd", "comment": "Malware payload (Mirai)", "value": "687aa19e59665e23a41aec23a7f7f14486e7b4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280726, "uuid": "70b92347-eccc-47cb-91ba-d6492baf429c", "comment": "Malware payload (Mirai)", "value": "94b6add9426290d3dd3a7bc152992aa129e37885943fdc45a59283fe30a753defc5a1e6cc0c260c36c5fe23838731408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280726, "uuid": "4416f5a4-28d0-4c8f-ae1c-cdd1ce525a04", "value": "T14B148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280726, "uuid": "0307eeab-d359-4658-9fd2-0d6938757596", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRUUKG:IcY5JpMByVs9jSLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280726, "uuid": "bf61c4e8-222f-4a98-ac57-67912ecb10ff", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280726, "uuid": "af952ddb-5645-499e-a015-be75cc31f7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280726, "uuid": "2b7161e1-d4a3-4cd7-85d3-6854b93a2ee2", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b660cdd3-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295993, "uuid": "86121024-ae07-4ea3-ab19-734958e4a4b0", "comment": "Malware payload", "value": "31cbbde8265cb5233008c3bac7d576d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295993, "uuid": "af5ba09b-19de-4607-af47-3c162bc318e5", "comment": "Malware payload", "value": "6e753ec653094369936b4185b49a9d4be8fcf4621c644bbe0f544cabb544a7da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295993, "uuid": "12bc0cb7-2044-4a7a-b5dd-f9f6b65f7d51", "comment": "Malware payload", "value": "89cc5218531a97871771f1b35a42fca1f05a5a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295993, "uuid": "165e0f23-8355-4d4a-bab9-accfa3880fd4", "comment": "Malware payload", "value": "3fcc82ed4de3682994d9e56b3e986781fe5c333eb99288fd9d8c073e3f08afe4e73af0a4693e4ddb9735452fe022e605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295993, "uuid": "7de6fcfb-05fd-4869-8864-3bc706f6c774", "value": "T1B624738ABFA13FFFD81ECD3702959A05129C490A5298BF776A34D508B68B10E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295993, "uuid": "d8981c96-f762-4ccd-b653-78d8bc9c7abb", "value": "1536:0a6AZsZEZbflEMZSFC2/E7n6nZnS6lRNoFbDr+flI9AMUuhlvoKcElaHfBcelr:H6cdbLZSFC2FlRNHlP+hlvdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295993, "uuid": "c70eb5d0-5253-4edc-928e-7fa38a1320f8", "value": 220116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295993, "uuid": "3af996e1-7057-4bdb-ba38-40086a04815d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295993, "uuid": "5f395829-2212-411c-a02f-2a31e819fd22", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455af5f3-e6f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767260155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260155, "uuid": "d37b4b6a-414b-440b-8f69-363a1d70ebc2", "comment": "Malware payload", "value": "857c19380d354b8223d040f9a1bd05a3", "object_relation": "md5", "Tag": [ { "name": "47-237-15-69", "colour": "#57D6E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260155, "uuid": "b49bc4ae-9374-4f0a-a070-b0589d90e504", "comment": "Malware payload", "value": "6e7e533d81d8defa4840d418e0216dae2cc0470e4188e48b2d8853068532c2c6", "object_relation": "sha256", "Tag": [ { "name": "47-237-15-69", "colour": "#57D6E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260155, "uuid": "6a243955-854a-4b78-9fa7-ce96ba8474f2", "comment": "Malware payload", "value": "d0dba71b1b362da86118a5512d6f66f74d5dd1d1", "object_relation": "sha1", "Tag": [ { "name": "47-237-15-69", "colour": "#57D6E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260155, "uuid": "a28367ce-a37d-458d-9734-598083be9c8e", "comment": "Malware payload", "value": "fe0b33f78e553b2b8cf45c211dfba9eef7c85cb0b295ac7027de3130e1ed31a27698b7bc71cb1fc999323d379b035f0d", "object_relation": "sha3-384", "Tag": [ { "name": "47-237-15-69", "colour": "#57D6E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260155, "uuid": "a4fdf167-ae1d-4372-8841-4e5d907d824c", "value": "T1EFF02790FAC8DE694B8422438049AF8DB1E8201A118EFE9A23CFC4D88059C81EB34569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260155, "uuid": "bb6c79a0-0cb6-416b-a4e8-6221de90fb59", "value": "12:CQFmoxSXBCE7EHumwLILknpHbnEBBwyvQlwvul74ExitJ:Dmox1E7EOzLILknxbnmwjlwWqEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767260155, "uuid": "54006c6d-62f8-4463-a0e1-c2685054f7cf", "value": 478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767260155, "uuid": "510a7d05-5d59-4d76-a30b-3786447129a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260155, "uuid": "b63cd0cc-895d-4b54-8968-19cbe8cae2e7", "value": "shell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72fa2bf-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293095, "uuid": "c2924d5a-e06d-469d-8c9e-459f45616dfa", "comment": "Malware payload (Mirai)", "value": "5c41cd039f91142da5c485c3abe4a1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293095, "uuid": "0485865c-1b6d-465b-8f73-31588290b2cc", "comment": "Malware payload (Mirai)", "value": "6ed4750e4b02c209861c253bc6cfec44593308a765363e10818d1241c2abe31a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293095, "uuid": "4725d2ae-bdd2-43f7-b201-875e0a6bda46", "comment": "Malware payload (Mirai)", "value": "abf80b116b11a35bcb0fcfb18bcd99c24d739eaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293095, "uuid": "1bec8d76-98bc-4053-963d-f585fae6618f", "comment": "Malware payload (Mirai)", "value": "1d02780a3371abaad708c592eb4764deb3c4cab1305ec99f2cc57228ad263a6d762da18dc6bcf39a1b114c8da53cb032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293095, "uuid": "461a23c9-2d45-4559-8d56-254239cd9b78", "value": "T1D8631297FBDC0B6DFCD926B807EA65CB1352903190B341A80CE65CCA846E9B121DACCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293095, "uuid": "37d267cc-208b-4640-a3eb-df821320cceb", "value": "1536:x7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgm7rPd:x7Mbp2L+Xqdfoz2sbrPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293095, "uuid": "cc611aea-33cc-4598-b9f6-c8c0ebd350b2", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293095, "uuid": "fc9bc0c4-d5b1-401f-81e3-0bb4de07a363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293095, "uuid": "e5c16313-4842-4273-916e-71a25378da38", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1a00bf-e718-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767275386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275386, "uuid": "a45cafd3-4d62-4aa0-868f-c40c8e027194", "comment": "Malware payload (CoinMiner)", "value": "ab6142c03988a5c1db084a0ae78c4f9e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275386, "uuid": "403c38a5-49f4-4038-93fa-ecd659bcd620", "comment": "Malware payload (CoinMiner)", "value": "6f335f8dae3e1169350dfce7e5f052ad47c2cbe764d3abfa748b13f4f8430f0a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275386, "uuid": "acba0028-1114-456d-b112-e5dd46db19dd", "comment": "Malware payload (CoinMiner)", "value": "91a344e44ef2d975c35e528ffe535af3940ab5f8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275386, "uuid": "5eacdd07-fc04-4759-a95a-8d77a1b045ac", "comment": "Malware payload (CoinMiner)", "value": "93c9780b1668f39aa8d9fe885bcde09d3b8e11944b9ec356b0cfb2f71d21d7d4f3f2b39880e4ac82648891e9d1c1e369", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275386, "uuid": "a8a57674-53c2-469c-951a-9c1dd1c0ce08", "value": "T1FAC7331532C159DCF9E243305263D7017BABB825533CC59B56E8BF4AAEB30351B3ABA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275386, "uuid": "8f0216b1-0b54-4c80-affa-6dd68e96a63b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275386, "uuid": "1e0cce6d-5946-4bea-9562-48ff8cb51153", "value": "1572864:SEWE3SCVLlD/t4QkXOs2dal6XTCh3jdY/VeLUfe:SEWERV1CQgOPHXTChy/0Ufe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767275386, "uuid": "24c23c7a-f1aa-40ff-906a-a0a5dbfa47d4", "value": 56706815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767275386, "uuid": "12f2eb21-bb61-4a40-b1b0-7aec4dcce0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275386, "uuid": "8fdc0843-7356-4a07-8cf0-a77c755f7eb5", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0ab315-e6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767232573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232573, "uuid": "ee5521a8-106d-443b-a44a-17c7b6ee4f7e", "comment": "Malware payload (Mirai)", "value": "21e76582c372d3e7b824a0cf5e260290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232573, "uuid": "f822a0a2-7877-46c2-b55e-c88aa427d6ea", "comment": "Malware payload (Mirai)", "value": "6f37016ad196fb5a355dae9cf3352d77e03b8dfef10219c04243cabadb63fa33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232573, "uuid": "5ac07087-6aa5-4e02-bb8d-484775427ec8", "comment": "Malware payload (Mirai)", "value": "afc831878c224e67b6b65e870af032d8bfdfc614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232573, "uuid": "c0f0785f-99f2-4036-bd7d-0f76cb2303c5", "comment": "Malware payload (Mirai)", "value": "b2e9c96ab23cf339a45a2baa9f9e7d19ac8f572b254bc6bf115529e4e8547d94e95514a0d1ca909ccd932ffef2c3a502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232573, "uuid": "55ffbad8-b05f-46b2-b348-1c8c1dd79054", "value": "T189240846BD918F13C6C122F7FBAE418D371A6BA9D2EA3103DD216F50378A89B0D37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232573, "uuid": "e0caa02b-7fb2-45fa-9b12-5606508f8580", "value": "6144:fad9rL2h5akUfkknJMHk8j4T5Nn2Q/Vo23y:fadJL00kUcGu3j4TH2QS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767232573, "uuid": "791852c4-48ea-4538-ba19-1d62488105c4", "value": 223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767232573, "uuid": "5282d6da-7ae3-4bd1-ba09-890d5378a2bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232573, "uuid": "775d6aef-3d04-4cda-b171-d5e64bee29e8", "value": ".5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b9f98a-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225878, "uuid": "427b7e6c-bde7-4bb1-94be-faf6fde4a910", "comment": "Malware payload (Mirai)", "value": "5c0b3177141aecea43640d77224303bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225878, "uuid": "613728f7-a17d-469c-b04a-33ead13d1a78", "comment": "Malware payload (Mirai)", "value": "6fb92b9d310c322b766ff083e5c7ed4ac40d378dd54243c5a3d0aa3dc3e151fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225878, "uuid": "e495254a-1a2d-4b8c-90b2-ff47d2a902f8", "comment": "Malware payload (Mirai)", "value": "e2a878366d1ae718622e7cf7aa9179b1430526b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225878, "uuid": "9da4f1a0-8fe9-4536-ab4b-76523ee93d96", "comment": "Malware payload (Mirai)", "value": "56b201ac709bf58545899029995620fa3711321d819c00a620d92a63a21a021be14f5df109c01bfa36e253b33b7ffc39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225878, "uuid": "51f142a1-317c-4cf1-9c64-6b40ae44b282", "value": "T1B8530945B881D617C9D462BBFA5E42CC332653A8E2EF7207CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225878, "uuid": "8979a84c-97f3-421f-997c-1a0269d1c572", "value": "768:yIfDANwMqyEdxGKeNrLEoT1ywnRidZTl+PAj7dekAuCPKyN+dvPz6suM7R:97eXqqLEU1PReb+PIMkrOKXhuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225878, "uuid": "c28ea160-b55e-45a2-a61e-f81eddb5b35f", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225878, "uuid": "3e0ec162-f356-4e90-b4d0-514cd72be39c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225878, "uuid": "cbfa4ffb-8831-4f44-8f35-73488651a841", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad608275-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254746, "uuid": "8824180b-d327-4897-9730-510f0705bc4f", "comment": "Malware payload (Mirai)", "value": "45babffd96f942eb2f4c2847c8b88296", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254746, "uuid": "84f26052-cb4b-41b8-9480-8b9a35e654fb", "comment": "Malware payload (Mirai)", "value": "70187d1faf0c941e42fabedcc9b769bda9090d5e90c4f9585c57b5d0bcca27b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254746, "uuid": "4a44b275-042d-49c5-bca4-2ec4089edea3", "comment": "Malware payload (Mirai)", "value": "b56a254e775de9e4f421d82fcd0ffb5acb144376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254746, "uuid": "2819853f-53f9-49d4-b350-85f0108ffc4d", "comment": "Malware payload (Mirai)", "value": "1d583769bb3f017d26b24c2e96c2e0cdd0a82f945ad38af47361ead532d7a23764dc869803b3224b81a050bb303a67ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254746, "uuid": "190aad84-852e-40bb-a767-167797177146", "value": "T1D0936C22B5791A2BC4E4947722F75322F1F6438914B88B1F7D710E8EBF256D02A077B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254746, "uuid": "98d6116a-ab29-4974-87ed-19d02a8e4a7f", "value": "1536:hIE4joLKKLA9ajoJGReRL/qUtnLYm5d/o1YCUqticad:/GKBotLVLYOdQ1mcad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254746, "uuid": "d7f3f0af-c49f-49dc-b664-1d67842bda50", "value": 92840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254746, "uuid": "2427fc4e-4937-4d05-b759-4059dc6cdfd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254746, "uuid": "8b044640-b3f5-4a7a-adc5-1da6a8ae0efa", "value": "m9x7k2v8b3.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ede5fae-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767280465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280465, "uuid": "7553fc9c-5bbd-49a3-9ad5-a67eff8f3bd9", "comment": "Malware payload (GCleaner)", "value": "36c86f4609c24cbe4bd47d075c14b1e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280465, "uuid": "d0189d67-0bea-4070-a024-004801dbd52b", "comment": "Malware payload (GCleaner)", "value": "7049fbb642f4e5f15953c67134a4c32bccc5f29c1265398e001c46c1914eed1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280465, "uuid": "619f6350-14f6-4199-bd79-cd31fe9bfcd2", "comment": "Malware payload (GCleaner)", "value": "db037e2f516a3e1e2679527811610cb43a84f16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280465, "uuid": "51770195-1559-42c3-8978-abaf2f4a664c", "comment": "Malware payload (GCleaner)", "value": "e67991141c4f44696eb1dc3b4113169dbb4ee7d29546172e1372130e8ade620f1a278703b849f7df79417f152b493ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280465, "uuid": "aa50807a-17f2-46bf-b7ff-fdd9d33638aa", "value": "T17926E1D7D123562DF3792CBF8DB231D2AA059C09B45CADC065931ECDA9A93893E1CB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280465, "uuid": "0a5dbe98-c31a-4d47-a826-b01e976c2b4d", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280465, "uuid": "41a96d4f-ea88-41ba-b8e9-58ea0a92eecf", "value": "49152:o4nCVNTXhPx/Kek9FlJ46rqEMtAFLjMFecOuGLR3lxZJz8GiiRweZWnJMt+SjsAx:o4nCVhxpMl5qvqLv5vJzvii5ZySOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280465, "uuid": "39df5c58-4a73-48b3-8114-ce1112f3a8e5", "value": 4590864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280465, "uuid": "a550a800-a6e1-46b5-809a-00179be6a935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280465, "uuid": "dfafd204-ab7f-4e10-839b-ab0471dbf74b", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcdb981-e6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1767234510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234510, "uuid": "aba30e0d-ea9f-49ce-bba2-196ceec1e8b8", "comment": "Malware payload (ParallaxRAT)", "value": "451189216479d2ef4c785d30e8712170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234510, "uuid": "abef12a8-3694-4f11-9538-42db1c9685cf", "comment": "Malware payload (ParallaxRAT)", "value": "7070d544037059cd4008cd5d631f6ba78bed4084df55c9ef94eaaf5dcc600a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234510, "uuid": "2118bf61-b896-4161-9e86-713d441dff7b", "comment": "Malware payload (ParallaxRAT)", "value": "96ec9f55d19be545cf3bff0cd8ec20c2d0e8a3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234510, "uuid": "f04abfa7-e07a-4ba5-865f-fcabf2febf70", "comment": "Malware payload (ParallaxRAT)", "value": "be08351543a62d27bf900853cd107bb2b83e441dd016e51aa95856a463092fbcdab3c41dc801347f4f6a166bb00f7eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234510, "uuid": "2d212952-85bb-4a29-a462-b3d653b44d1a", "value": "T18EE4D01DB24E81E3D4C00D38E3E3B3111725BC7F5A71D49BB5846B68DCBD2A4DA89A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234510, "uuid": "19d4d6f5-bd94-4f6a-bbf8-aa58b8821640", "value": "151cb684d328118cbcb29c80e832621c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234510, "uuid": "eb97fe2f-1ab9-47d8-9332-9cd473a2cc59", "value": "12288:LGY+DE3pRg7fMV6KS3DVpRUKf3Lg40CaZpQfE/TC9C:xH3zg7fxdUKf3LN0LZes/W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767234510, "uuid": "7be4214a-444e-48d5-8df9-954bb3412d69", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767234510, "uuid": "21d4547b-7666-42e4-9b36-39f589675983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234510, "uuid": "215a7704-9021-4048-8420-cb53e98aafdc", "value": "SecuriteInfo.com.Variant.Application.Babar.35877.14528.32175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4b981d-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233299, "uuid": "9b7a6e5c-293a-4e36-82d3-0b0a93f1cedd", "comment": "Malware payload (Mirai)", "value": "0e6d36e6a5e51d6777a47ebfa2115a84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233299, "uuid": "00b5e280-0acd-446b-ba0f-c64075e1918c", "comment": "Malware payload (Mirai)", "value": "707840d521b2dd3db1761c4d0806ba4ad5eea434fae270e1567e75bdc4cbb4ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233299, "uuid": "60b876c5-b395-4b52-a6d8-4ad620ba6148", "comment": "Malware payload (Mirai)", "value": "080ccec5c6222771202f452ab1a242e9ba9d3f6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233299, "uuid": "4106d750-da21-4e54-a92f-5bda5b8cfb5d", "comment": "Malware payload (Mirai)", "value": "2ec9f607d767060ff90fa9fe89ea0a74248a17d5073fd25931172e434bb9a6a03e239a84bd5bb14bc3b518d13a271a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233299, "uuid": "6d5c6c68-4e02-47ed-9af6-a879555805f9", "value": "T1C333F1C6E0902469DFB7BF246C1746657BDA4FDE1E5A6C93026F8F205E5A83F8308C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233299, "uuid": "70d188a2-ac76-4374-b2ec-2d0555dd1223", "value": "1536:fnJbta3BPOT+QDC/ZQzrZ3Bs/Y4hQjG4u+qgw09O:fnABk+gmErVO/zaS4u+qgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233299, "uuid": "eca84fb6-f1f7-4f15-9a5c-1a8f854c40fd", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233299, "uuid": "cd5fbc6a-a83e-423b-b69c-b92e80981e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233299, "uuid": "fecdcd3c-1a92-4376-9d28-bbbe03734657", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3f89a5-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270666, "uuid": "4fb22a30-d4ae-4f5d-81b1-1d8a09772f64", "comment": "Malware payload (Mirai)", "value": "9ed2193d283e29ec787b0eaaab7fefae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270666, "uuid": "3d91a69e-c27c-48b8-9554-826c2ac34141", "comment": "Malware payload (Mirai)", "value": "70989a77cc5f5382bfdceef216ac46d0c274e8f6baaec2a251ef72ae0a66d25e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270666, "uuid": "cf2fd4dd-b664-4592-be7f-54c9eb978b07", "comment": "Malware payload (Mirai)", "value": "be1dfd9190ff9aff45b662fd2768a493178eb4e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270666, "uuid": "df554d2a-7c03-4ac9-9472-7bb830e6f8cf", "comment": "Malware payload (Mirai)", "value": "f4e5cc41e59b63f1c1508b1050ee5cf50f42fa28797101131a750881f94903c470ebd1989e4de0a3cd6ae80e7f10e4b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270666, "uuid": "380285ac-48b2-4318-9597-5ae907c3200a", "value": "T113435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270666, "uuid": "9335ce0e-655f-4137-871a-67e82f031f30", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGABB:ybUg1Jgzz4Cqu1Hisi6nSgG8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270666, "uuid": "ce591cc4-5a44-403c-ad9f-45bae29a87d7", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270666, "uuid": "c621dbdf-6fb0-4ec5-b62f-9e641f6a2bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270666, "uuid": "6734e346-21b6-4ab7-98cd-0f5a4af29dbd", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb18adf0-e746-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295249, "uuid": "867593a5-b94a-4f6f-8f5f-89d7c38a4fdc", "comment": "Malware payload (Mirai)", "value": "9b82287fde184d53ab2c6f40a769a510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295249, "uuid": "f361fcd3-6850-4d94-bd2c-2648123fda9c", "comment": "Malware payload (Mirai)", "value": "70a3c213d8c147d59efc989b097c9f3029af964e03b3700ab3b999e4b045c507", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295249, "uuid": "41379921-5cc1-456a-a0f3-914fd67a11bc", "comment": "Malware payload (Mirai)", "value": "17611a5ee6847667ba764ee5cf5eb904047bec06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295249, "uuid": "3d468bdc-d7eb-4162-9178-7f3ee2fc8cf9", "comment": "Malware payload (Mirai)", "value": "b69a3b5b2bd1e00d99e514a8f79f4fece9e1cc8b27b5f9c2ee4a6884961094e09f421cbda88477bf41ee5e6e48e27cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295249, "uuid": "e3d263eb-74bb-4781-964b-364224179c3d", "value": "T1A152D1D123423685E222DF793F9C340F905C88227139A7157E55D60AD82FB1848B9BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295249, "uuid": "a2d8d6d3-4121-4926-8b27-dca7f2a3972b", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY:yb2eX3zAKuiNPZRwwqdvrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295249, "uuid": "e5d600fa-85c6-4266-87c8-b72e446db4ee", "value": 13800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295249, "uuid": "a32c2200-5d41-4ddb-a4ef-322495ee6cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295249, "uuid": "22b777ca-701a-4fcf-bf7c-01283a32bfec", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a821cdfe-e735-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767287808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287808, "uuid": "a0a82346-7137-4eed-8236-70710f700489", "comment": "Malware payload", "value": "73cf5c73a928cf8645de2d22c3701033", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287808, "uuid": "5b7db0e7-11aa-4950-a135-757a6397f1d8", "comment": "Malware payload", "value": "70b8325372c1e86c7b3ba9c73bd2f433e401a2b57e1c93699342bd1b4c0bf71d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287808, "uuid": "6c65486e-ccaa-482e-a8b0-8d89be5a74d9", "comment": "Malware payload", "value": "2bacc069fbd915345307d273cf5cb023d51a0224", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287808, "uuid": "cc689c3a-947d-4f09-9db3-7f91bfc237b6", "comment": "Malware payload", "value": "7cd4badccea3fd21b27a28e180c481d9227249bfb2fcd2461d9da6a976cf5cfada235cd22e102eff57c4957d646c8528", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287808, "uuid": "6085381a-071d-46f6-b089-d5e52e482684", "value": "T17BE633186BD00AF6FEA3D03ED530D8B19232795377B2CD6F431846912DA31D92E376A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287808, "uuid": "4007b763-0a5e-4681-b18d-a3f58a2d02af", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287808, "uuid": "49023a20-2afc-44b2-bc04-f7fe32409f19", "value": "393216:YSiDowGaa5wEMiuHCliuCWDvV+53SM8+Eg4NDb9:OLaGziuilnC4vV/M8+h4NDb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287808, "uuid": "cb27c399-4621-48ab-b436-eb511ebc3f65", "value": 14318343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287808, "uuid": "6081fc39-2301-4f13-a72e-ab3acc0646fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287808, "uuid": "19fce25e-0563-4b5a-bdf2-af5ba01b6fd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01675c7-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226082, "uuid": "56982910-8724-49d5-94cc-63f67a68cd9c", "comment": "Malware payload (Mirai)", "value": "8c3feffa4b4d7dd9043f56a7faf54171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226082, "uuid": "3c8bcd35-9e1a-4037-975d-12d310f4172d", "comment": "Malware payload (Mirai)", "value": "70b90e77745e369a7417e64019e4bbeed4432593420dac931a985e57eeb112ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226082, "uuid": "e0ef89c1-0375-4ccf-bf30-f8b8f79627a6", "comment": "Malware payload (Mirai)", "value": "fd8cabdaba06743cba810f04c336e69c3f1e182d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226082, "uuid": "a12f989b-184c-4eda-99b6-0d3012aef937", "comment": "Malware payload (Mirai)", "value": "e606e0c670e5513e655f61cf0e9e63e86f9b1fde285447a0e737df17e9b0e5f244649580a3a6907caa11cd610f0df284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226082, "uuid": "e5d10b0c-473c-41ac-bfa7-0cbb960e7eda", "value": "T133D32996B8819B20C6C256BBFE0F528A331357ACE3DE7213DE141F6427CB55B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226082, "uuid": "b356a3d7-b22c-427e-967d-650c11a34d44", "value": "3072:UiR+4tpDPHZlsOkeY7LDhbgUrVngBaTRqzNa6AGKizdY3p9F2GDnT1:UY+4tprHZlsORY7LDtgUtgBaVqpaniWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226082, "uuid": "7f877514-3e37-48d1-9cbc-da9f60ee9b7b", "value": 132232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226082, "uuid": "3d812ade-cb86-4f5f-b1ac-2e23cadd80fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226082, "uuid": "d227389f-4f29-4ba3-b792-77e95756fbfc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c71074-e6b4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767232287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232287, "uuid": "37c4d7cd-c920-44b6-a56e-c535548e9521", "comment": "Malware payload", "value": "0354ed1c4628494eaf523ba2f2fe0745", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft-token-stealer", "colour": "#C4BD8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232287, "uuid": "086f288c-cb09-41fd-b9da-4212b4f2dceb", "comment": "Malware payload", "value": "70eccdeea9ea007816637b4108ba11d0ff34966e19f032c25e3f13cc9656cf99", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft-token-stealer", "colour": "#C4BD8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232287, "uuid": "d35bb1a9-f6d1-4c7d-adc2-42384104ef81", "comment": "Malware payload", "value": "53aeb05e78b36a3f2cfafff8e4248f36a0634265", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft-token-stealer", "colour": "#C4BD8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767232287, "uuid": "495ac4aa-832d-4c12-8db7-f76ba47eb1a4", "comment": "Malware payload", "value": "6b8c626b5702870752720629df2f748b4b753ea8c1e5cd74e7af430587925f0bf27330c312deb297951fdb03b59b0d97", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "minecraft-token-stealer", "colour": "#C4BD8A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232287, "uuid": "20261053-f35a-4acd-95b7-15c37ed8fcb2", "value": "T188A42387AF21932AE32A003478C3AF15FB14E09D5DD834265F77F9EE98C19A1249E4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232287, "uuid": "8aea59b3-ba4d-4253-828e-b4b42f0c6f64", "value": "12288:9fwIA47JLtpYJe8ax/cRRIBexbjf+IDGTrQRUPc:9YlE7Y1aWwexbKIsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767232287, "uuid": "5a9ee2ac-e5f7-4042-9217-732eab68ae7e", "value": 451492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767232287, "uuid": "900574f8-c2ab-4b0f-adfc-eaf9a8c43b50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767232287, "uuid": "51a1c238-0e5c-4562-9616-d53b274e17a5", "value": "Macro Mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab4d487-e6ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1767264620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767264620, "uuid": "b5d1e363-09fa-47f8-84bb-7d3db67d8a3d", "comment": "Malware payload (Sliver)", "value": "0ad1dd8f12b905500856c6665e4f3384", "object_relation": "md5", "Tag": [ { "name": "43-199-34-191:8000", "colour": "#5B73B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767264620, "uuid": "e63fca58-ba39-4424-80e0-8c1e47cef86c", "comment": "Malware payload (Sliver)", "value": "71c1a680353e981c3c9bdc29b6891f40137fc1a6a28f53654adb80f3d22c77f7", "object_relation": "sha256", "Tag": [ { "name": "43-199-34-191:8000", "colour": "#5B73B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767264620, "uuid": "63ebbbc1-ebe6-4655-a268-e1261160a540", "comment": "Malware payload (Sliver)", "value": "8a6cfddf1d893be698cbdd855a4c544eaaf2940e", "object_relation": "sha1", "Tag": [ { "name": "43-199-34-191:8000", "colour": "#5B73B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767264620, "uuid": "e0e7c43c-c2bd-446e-a022-1ec46ba84224", "comment": "Malware payload (Sliver)", "value": "12af509803254dfdddec74040bcdd1efd5aefe6e7cfa7966071ad9eadf81246999cb4fae2c7238d5d0224e69bb7300dd", "object_relation": "sha3-384", "Tag": [ { "name": "43-199-34-191:8000", "colour": "#5B73B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767264620, "uuid": "580ded15-7382-4f9f-ab96-1b919904e021", "value": "T1CEE63C03F8D610D5C5FAD1B489214262BA70385C0B7973DB6B61F7B42B32BE09EBA751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767264620, "uuid": "929b7b1e-fd53-4d2e-ac1d-c7583a30e960", "value": "98304:gp1a+5u6lT4OGNTUWl9a5ysK2Y/dEQ09fI9A72r7alW1EVhhqukfF:gp1ZTfaTxlY5ysKN/d29Q9YKuYNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767264620, "uuid": "fc20f665-c1d2-491b-803e-cc2faf26d24b", "value": 14405632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767264620, "uuid": "08e35380-77ad-4e73-9f1c-446a4ed4bbdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767264620, "uuid": "2581c46f-5770-4d6a-9ccc-a26fc358020a", "value": "ep", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc2478b-e746-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295250, "uuid": "b0541277-0d7b-467e-ac25-46857df4334c", "comment": "Malware payload (Mirai)", "value": "34f13f3f6174226bb9049bb03e81661d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295250, "uuid": "54db6109-a9b7-42be-b9c3-3a4d6d8fe266", "comment": "Malware payload (Mirai)", "value": "7255f07a09bf28c147e8ed9eecdf51a8e825c8b6ae033e17526b53690c78ceef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295250, "uuid": "ef68e437-e346-419b-a257-46f9b07c5731", "comment": "Malware payload (Mirai)", "value": "96c9e09332674ba5714ef01de1f97f3a5ad00b5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295250, "uuid": "b4794634-4cd3-4c33-a148-f9aca33cb733", "comment": "Malware payload (Mirai)", "value": "61eff633a2215d03aca0d27bc20dfdc69bf600287cda0e6502b5a699a82dafcf28604189a5fd151eee68e7bd51d80984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295250, "uuid": "578b2391-69f1-4da3-964a-4eb1e8055efc", "value": "T1A3B35C52FD92DA12C6C16277FB1E428C371743ACD3EB32078E266F21728A91A0F7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295250, "uuid": "1d22addd-6f39-4ccb-9b4b-b05463ac14ba", "value": "1536:e5wREbOco06xSs5oFepAdtgPXlHDy2Wv+lbdNd1+u3JEfX/OdgwhLeN8QvLOu:e5wRuOjRxjoFBdtgdTWkbrz73Jg64T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295250, "uuid": "28d5d4ad-e7d4-4dd0-8d88-7888c555ad38", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295250, "uuid": "b7ae5410-b58a-4383-a476-8524000117ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295250, "uuid": "77d232cb-a472-455f-87b6-3dc71ee59daf", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72f27ef-e70e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767271191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271191, "uuid": "a6195a82-08d9-4cf1-bed0-a31cb45b4868", "comment": "Malware payload (Mirai)", "value": "c0237afecf741c598a967c383a796c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271191, "uuid": "ba556835-1728-4f3a-b8a3-7b67f28d5892", "comment": "Malware payload (Mirai)", "value": "72d1c5a7bf9a431c5c1de13cc6ea500fe18f4b47ff0c7cb657e07f285c9913e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271191, "uuid": "110201a0-7024-48fb-a5a7-5039d12f6a9b", "comment": "Malware payload (Mirai)", "value": "147f169abba43813b6b59c239decb4403774f837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271191, "uuid": "2df904cb-b8a8-44c6-94eb-c70280016402", "comment": "Malware payload (Mirai)", "value": "f1406a3141116654fd23ab976d7a57a8ec3fd8527ad2b469386c4be1cfbb4608ab4784435485c52903ba89d8141fe464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271191, "uuid": "a734ab34-571b-4562-a1c9-6990362027f3", "value": "T1FBC44B59F8809FA1C6D5257AF74E829C33134B79C3EBB20659145B343ADB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271191, "uuid": "3f4e1994-d3bc-45f5-b9f7-d4db47856e78", "value": "12288:B3tg0X+X6d80czmd7QfiPX3MPIzsgpZ6m+E:ZYQ89zmd7Eif30Iz+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767271191, "uuid": "45924870-367f-4485-a766-01d581cfb5f9", "value": 549540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767271191, "uuid": "3263d97c-52bd-4970-9615-5ae75fad9a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271191, "uuid": "54b6883f-7acb-4439-b05e-99711595c3a5", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a929074-e6b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767231844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231844, "uuid": "e3a55ef0-730e-408f-9998-c98d5327b641", "comment": "Malware payload (Mirai)", "value": "3a2ac6771022b15660e8846a93a1c6d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231844, "uuid": "42744259-a4fb-4a74-8d2d-0b6e35b8ae0c", "comment": "Malware payload (Mirai)", "value": "72f78ab333e0ee1a87754dfb1660a68153141c9af3fc9bb610350304819494c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231844, "uuid": "33e7163e-9aa7-4f2c-8b77-269171111466", "comment": "Malware payload (Mirai)", "value": "3dc1bfd8d9a17754dc5a11f55fae202e5a8bd37b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231844, "uuid": "fd467e52-8b3a-4550-95d8-4ccc77c5ca2d", "comment": "Malware payload (Mirai)", "value": "b6be6845de6f1c0d27a2c3a902737232db0db4b1f2b4b8c11052cd11d20fbde814cdc74d1bb071fe7d5e4af46a8a1631", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231844, "uuid": "95c745f3-90bc-4c6a-9a9a-f4749c41b012", "value": "T1B0F0BB9FB1247E13514D8D6B77B2061E00A1938C2917079EEDE2547A84E9780375CAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231844, "uuid": "d8d821a1-d521-408d-addd-ac2afa2d3e8d", "value": "6:SdCNbTZ6WYT0FdAWJNKZjXIT0FdmLzPEiC0FdmwEc0FdmuNNIF+KZEBFIS0FdmSz:6aTqwzTJTwmLcwm4wm6NIbMTwmSak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231844, "uuid": "e020502a-502c-4fc4-86e5-dedb59a213de", "value": 505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231844, "uuid": "a367ea9d-71f3-46af-98cb-4212740af55e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231844, "uuid": "13cf77e6-a252-47c6-9e44-f7e5b826b8e8", "value": "po", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9aee42-e75d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767304759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304759, "uuid": "5e81c751-7a0e-44f3-9090-cf5c292bda6f", "comment": "Malware payload (Mirai)", "value": "c1ab1121c48e2caa39feb30947dc3c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304759, "uuid": "14674f80-951e-44c5-8851-6cb145784dbc", "comment": "Malware payload (Mirai)", "value": "73f926e434feeebc793a3e87ce44dbd12deb1e5badd1c462227e57d0959bc3cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304759, "uuid": "dc603c54-5580-4c31-9c59-d0d928877506", "comment": "Malware payload (Mirai)", "value": "91541919806b974eed3423ad08c2610aa66da4f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304759, "uuid": "5d4c0df9-8bc3-4c2d-890c-98f1a598567f", "comment": "Malware payload (Mirai)", "value": "70d431e74ea669f860d01795f2db9d73f23dca104b9965a62f3299a13ed29d1a8d012c479cc5b47a27a7f683439350cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304759, "uuid": "4fe09e0f-edfc-4a84-b73b-0e7566c67a14", "value": "T12B049C37DC605ED8C624D5B4B0E5EE7A1B13902554839EFA69A7C2B28047ECCF9097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304759, "uuid": "5a856fc4-7974-4615-bd6e-4ef1c9b447ce", "value": "3072:yT9cLF1kuTWxN3W5gmZWFQ9FtX3sTq59f28WX33Nem6hh1ee:y81KxJWy1FQ9Ftwr1XNeEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304759, "uuid": "ed8e9034-8c86-4066-8c5d-eabfd4967421", "value": 181120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304759, "uuid": "010e8b62-1a29-4123-ac43-37136d45aa14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304759, "uuid": "023c4567-5ea4-4b9d-9b3c-6205b076066d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f537149-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767279928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279928, "uuid": "11df4e5c-a5ed-4eeb-a87d-fc70628f0e38", "comment": "Malware payload (SalatStealer)", "value": "5962386e8c5c31d3c60b63925c15446c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279928, "uuid": "8c1dc395-4eb8-41e1-a988-8af7183f6db4", "comment": "Malware payload (SalatStealer)", "value": "746afff96ed8899058af0271abae9ba32e9bfa66f1930bd7b7fd0c493adc64b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279928, "uuid": "dec6c81a-3db9-4ce0-8cf6-5c54ab65ba86", "comment": "Malware payload (SalatStealer)", "value": "328432ad9598f46c98704d289db4e5a40f2d1045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279928, "uuid": "5dc19ff4-eb25-40ae-ab48-7553b8599142", "comment": "Malware payload (SalatStealer)", "value": "a0f64f9ed4337b68a580496104e0d72137784a92b5fc87130284f67609e673691c0338c0bd9f4c19c03225d1fac4f88a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279928, "uuid": "4f19b0a6-3dde-433b-9f0e-49301a629623", "value": "T1F3E533ED4A2B80F8ED178575F0658F0CBC2FAAD6EC58E99194A1313B34D1A6E132153F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279928, "uuid": "5b0caeed-9807-4514-86ed-f1de4793d63d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279928, "uuid": "c00909e1-ab12-4c8d-859e-db429d946159", "value": "98304:RAjXZ9N/U24m7bFdSHOned0OyrBdoh8XEZrOjU83RDdQ8:MXZ91pL7bajnm/rUr983w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279928, "uuid": "5bf3a67c-6cd8-41c3-a563-6736b64d7615", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279928, "uuid": "8b6dd0cc-e6c9-4652-8c52-2415998506c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279928, "uuid": "27ef9468-a272-4b6c-aa45-01560a4a3fff", "value": "BLUMECRACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d749f01-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272141, "uuid": "cb3856ff-a13b-4d6f-84c3-96bb7147fd5c", "comment": "Malware payload (Mirai)", "value": "c980ba056f7b47b59023dfe8a4989ace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272141, "uuid": "ffd2566b-87fc-429a-a33d-a6400bebd9ad", "comment": "Malware payload (Mirai)", "value": "74b5e45c73c16c2324f5cf5c8d74debba4e16779d1c5da430b05f31d80592a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272141, "uuid": "6e3719fd-f3c9-4d86-b7a1-edc1d4d39305", "comment": "Malware payload (Mirai)", "value": "d581d8488f93ed467e348b01489f72d5b5c81c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272141, "uuid": "3d77c85d-fd22-40aa-ae56-08193977d458", "comment": "Malware payload (Mirai)", "value": "76513b0fb1a35259da096cb9e14c96022dc76d576a953b2c6a7022798664efe58c2567d5f7c585e00bbb59bc2974482e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272141, "uuid": "1121321b-1a6e-4f51-838a-d42215a5be10", "value": "T178547D88BB4DEF03C19483B6E96B0623A33934517B4BD7637825612EEDD37D85C5328A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272141, "uuid": "3176ea44-d440-45ea-b6be-790d6ff16b25", "value": "6144:sCklHVubHrIs1AmhkKCGs9QWOgLohjE0L4rlTd:5kqHE0gtQWOQohGrhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272141, "uuid": "b9dcf363-2523-4bf5-9d28-1ae566a62d96", "value": 297096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272141, "uuid": "3eb98bba-a47e-4153-b9ce-4c93490e68e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272141, "uuid": "4e3d9331-d039-4651-bc3f-77469e8c3686", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020be0b5-e731-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767285812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285812, "uuid": "4a246b14-e509-4a77-9cbc-7747c3794556", "comment": "Malware payload (AsyncRAT)", "value": "b0a2518877cd5cf1c7c514a528d50713", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285812, "uuid": "dd67a2ae-5a82-4b8c-9ccc-75a4bc9e7671", "comment": "Malware payload (AsyncRAT)", "value": "75a317d6d229fbb1b907714f316fd9c216d64f52ede192663ae3e056e7df550c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285812, "uuid": "cf5e7e08-1e74-431b-80e8-e5ec6bbb3cfd", "comment": "Malware payload (AsyncRAT)", "value": "712baa84a853436e8249eb165781cfb4b1674b09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285812, "uuid": "d2faac71-beef-4b79-b39e-ede5a67037e5", "comment": "Malware payload (AsyncRAT)", "value": "581012b258fa81367f402b0062b712a2c014d8639b68c914e67b5407785be823b59ba11025ed14ed5d79632dcd30fb86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285812, "uuid": "d4190326-7611-498c-b930-aefaa1e14c55", "value": "T129232A0037E8812BF6BF4F786CF26145867AF2A36603D54E1CC455DB5A13BC58A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285812, "uuid": "9cc9f9a0-21fa-46d7-a479-196d95633391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285812, "uuid": "3dee83d5-cc8e-48df-b9e5-f4d75c6797af", "value": "768:LuCxNTAolrhWU5ieLmo2qrjoKZI/JtxyhgPI9ljb6gX3iTxETPULS62BDZrg:LuCxNTA2Z2soKG/Ji9tbtXSdEAtYdrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767285812, "uuid": "3eac0361-f045-48ae-8f64-377c423c9d95", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767285812, "uuid": "0b18197c-ff77-45e4-b51d-c153779c4214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285812, "uuid": "1a6bffae-34a4-46ee-bb19-1b0de4a8fe14", "value": "global-odds-hub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3f9196-e726-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767281183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281183, "uuid": "63142042-9169-4bef-87c1-5b2e3a1619a8", "comment": "Malware payload (GCleaner)", "value": "14d724439b82615c548ea5b8e480fc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281183, "uuid": "68e0555d-dfdf-4001-b0eb-d2d6d9ef776d", "comment": "Malware payload (GCleaner)", "value": "764c556aeba31be5e5b387c7c29156cbefbff9440240afadc24f39dd1f7e5047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281183, "uuid": "b83b3beb-f652-41cc-9ce7-31c088cad4c2", "comment": "Malware payload (GCleaner)", "value": "79108f6259709a7c789d0fd4a213f743b0c8f193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281183, "uuid": "5a2cc1a8-8bfd-4f96-9479-67f4e6592a46", "comment": "Malware payload (GCleaner)", "value": "9c30e78f5d85222c2e63cd873db004cac803825264bdeed33557823ecb7aebf9c687dfa6d78c6e3f8434f54bc9160888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281183, "uuid": "d68a935a-ce5d-46a4-a3bb-05e375850469", "value": "T13206E13262D74B39F0721A3EBCF7562F44397C496836D085F9EA39AC411FA9534A03B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281183, "uuid": "9019dff0-f59c-42c8-9080-9c076b704dcf", "value": "d9602d58db63e796034d7dc7a7754fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281183, "uuid": "d7979981-b01a-4599-a2d1-c750d6ee3439", "value": "98304:HS2bdScqvqUInA9o7lD+KlaNk951Lki8SUofe54:HZ8cLLnA98NiW5BoSUofeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281183, "uuid": "71ce0ebf-2cbb-4083-a5ad-25c54dc9adef", "value": 3782928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281183, "uuid": "3bac0e3b-5267-4e70-b8f7-7b1a3dad254c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281183, "uuid": "2fada129-cdc4-4ad6-8836-b4ba764ba998", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb54877-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233295, "uuid": "fe3bc963-2704-4e1c-b238-300706b95b86", "comment": "Malware payload (Mirai)", "value": "9386cb6558266f49e6979b82cc86fea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233295, "uuid": "f194baec-2355-458f-8862-b65e4a2c5e0e", "comment": "Malware payload (Mirai)", "value": "76512eccee6de107fa43fc54633b6c9df382d36b76ccbe51cde2d044930d0881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233295, "uuid": "d98c7470-7696-4b47-90c2-bfb699a09a85", "comment": "Malware payload (Mirai)", "value": "5c396acf34f6ef393e3800ac83934a9c11968b65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233295, "uuid": "008a7706-249a-4682-8403-90aa480649dd", "comment": "Malware payload (Mirai)", "value": "71e38608b5ecf7b06ecf54309d9d4e95e0d132824ece243de6eb55493af0c939fc20709f28ea52e5e4802843b6fb58a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233295, "uuid": "1dfe5f56-1979-4f22-98e5-6a0d8431953d", "value": "T15BD37C73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233295, "uuid": "8341f3cb-17c2-42f1-bede-baa91f81db84", "value": "3072:oOuckx3SPZjjNnfXDM3dLWIK1Er+6hh1L6b6:oOuclVjNn/AdaIoEN6b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233295, "uuid": "881456c8-4519-4444-877c-4bc40cf4871c", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233295, "uuid": "67a0e8e0-0cf4-440d-8157-a9d5c11870ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233295, "uuid": "fffb3906-d6da-4085-81c4-d996da538321", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231f5a5e-e74b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "1ae153db-c11e-41f0-bf90-f1d5952073af", "comment": "Malware payload", "value": "9ccadd669593de88772d85f2cac2b3bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "ce26e6a3-e1bc-4852-9c9f-e5b0e4f9adf3", "comment": "Malware payload", "value": "779e8f938001647a67b427faae0182dbe4fd2cf8fbfd761e007b42f4b7340311", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "3209a255-51bf-489f-9695-165f98c8fd23", "comment": "Malware payload", "value": "3674be9b2d46c690cbc24a7d30de99839febe175", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "75e58618-acf2-464c-a140-61f6f08fa739", "comment": "Malware payload", "value": "765e71ee80b244d8786bd9dccdd39e651e6d4e7f9541b5bf7720cd631011198cc637676be706d17d34f136bfdb4b15f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "0be0f8bb-a8ef-40f7-aa65-5856c796157b", "value": "T1CA04071B3FF28BB9D887553049B087A5B3F58AA4C715D45360BC43DAC7A2791CBA8B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "7651170f-7700-445e-a3cf-ba6e9f964dce", "value": "33e0eccfcce7209dd02a39348d18c84b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "19ab3f27-a51a-420c-b020-6c9f6d6281b5", "value": "3072:ErquciI/ZjQScrAF2OXREwx/HLkXrvBfMhN4HK+e1V3LSqGY:0quciI/ZjQScrAwOXRbUr2hN4q+e11uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297034, "uuid": "2a1545d5-f0f2-483f-a340-7455e56b2693", "value": 184848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297034, "uuid": "1bd6927e-576e-4350-9ef0-8f03113fc9d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "01fbf296-04b9-4ac7-99e2-4f908fc3345d", "value": "csamsp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c017b2-e6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229691, "uuid": "78435cf4-8972-4238-a420-77ccf4620afc", "comment": "Malware payload (Mirai)", "value": "2fe24a5466432fdd279dc1cef2e20136", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229691, "uuid": "315b2a5a-d943-4573-a134-7b656b089049", "comment": "Malware payload (Mirai)", "value": "780ac7ab4cd9627c2a20d9be6d5fcab1715c58a7a013a8f1fdf018dcebb81fcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229691, "uuid": "b3db4062-4dd8-4898-a94e-bfa31a23f9af", "comment": "Malware payload (Mirai)", "value": "dab14ab93f020906e3dc7528bc93f93998f01bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229691, "uuid": "7e884771-4df3-4227-8cfa-a0257ac2dde0", "comment": "Malware payload (Mirai)", "value": "09b24563d00bcc929ac40567d33becdb23048e2700637683660ce1b7900b208066cfd9af7dc4a112e8fbe3dc00e25ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229691, "uuid": "1cba6290-c5fc-4162-82a4-ab2659f73389", "value": "T1F2338D66C4BADDD8C18846B5E8318EB42F63B201D2531FBF1A9595695043EECFA0C3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229691, "uuid": "c78fb1fc-4523-42b2-851a-2d2dce7b41ab", "value": "1536:LauwtlnxmS/kpDisFdhKJQDDU6SwMC6nuM7R:LBSxL0isvhKJQs6SwMPuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229691, "uuid": "314a67a7-bc95-4c57-ad09-d7d0dbc73a6f", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229691, "uuid": "efbbd854-c7e8-42b7-a818-84c1e91b16b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229691, "uuid": "edfaa152-c4f0-4f22-8dc3-46d36bc61b48", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e5335a-e71c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767276953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276953, "uuid": "4fdd3068-167a-4f30-b27b-498b1ef6baba", "comment": "Malware payload", "value": "e1efd404eef070cb2a1d67a24fdd943a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276953, "uuid": "a0a69e64-d340-4971-a14b-b7995ebeded2", "comment": "Malware payload", "value": "7879d030a6fa452dbf1132e12393942b7d9953a9629d5e93295939a3dee83eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276953, "uuid": "ca0f69c8-52b5-4662-b3bd-83bae7ffed97", "comment": "Malware payload", "value": "f5415ba5a7707b7d8400df4d30f4168d3c5b0730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276953, "uuid": "2e34c3bf-8302-4217-a4bc-7b283daf0d2c", "comment": "Malware payload", "value": "6e681bc54af06347198d706db2635336cc833c563956bb0583875fcf3d3a3fa3b12f4d025da76647bba3d9f16f2146d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276953, "uuid": "0e9019f8-07a9-47d6-9308-3d27f694d4de", "value": "T182E63B57E8E25AD4C4EAC2B1D12A825BBA617C0D1B3823EB1690F3701F33BE05E76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276953, "uuid": "52a9fe2d-01c2-441f-bf49-eced36236a64", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276953, "uuid": "9408ffbb-d25e-4f54-b166-b32627816afa", "value": "98304:R8BOKm9f5KyTQeTnBUhtkSw/fSgzjV2JhN0iH73M:ReOv9xKyMezBUhSh/fSuV2Jhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767276953, "uuid": "1e7c8b11-04fb-42bf-81e2-fd50dfe71611", "value": 14348800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767276953, "uuid": "fc71e27c-bf89-4d07-b599-3224a64e2ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276953, "uuid": "bdb36cad-136f-4209-8838-8c046c76d2f5", "value": "Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629763e5-e71d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767277384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277384, "uuid": "d9538f74-6da5-428d-ad6e-be04848e27cd", "comment": "Malware payload", "value": "199f09c7559d5c1aadb818cd94f562ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277384, "uuid": "5b532e83-d8ce-42c6-b35f-b53e9559e2d0", "comment": "Malware payload", "value": "78a503902223bffc536c435df9e43364c822899697f409122a6ea23db0fb1c2d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277384, "uuid": "6db90f4e-fa4c-48ef-bb02-23c57a35d2ce", "comment": "Malware payload", "value": "28cbc32af1d054d824ca9936b84243d6fc51326f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277384, "uuid": "6a732d61-0816-4b29-8568-7cae2da5a3d7", "comment": "Malware payload", "value": "88fd456389813139e58f2984f6c2b0369490dd95e6f77c55059817b1cee5489bfdde3831e35f50d623132316e3647f9c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277384, "uuid": "489119fd-086f-447c-a38e-e2c7c73dff37", "value": "T184B64A83AE485325DA9FD339D5B1A2456230B085133112D7BFA907A68D1BEC8573FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277384, "uuid": "99682ec5-0ad0-43ae-ac13-1772b65da832", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277384, "uuid": "103bfca3-7cad-48e2-950d-25b189ffc2d1", "value": "49152:l4nctogrb/TqvO90dL3BmAFd4A64nsfJfIZ6g2GB4D0TziOURq4ETzAkVuFDOySo:l4UZ2L4CySvJXqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277384, "uuid": "bfa563cc-2f7b-421e-b15d-abf72a40ce47", "value": 11311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277384, "uuid": "e5cffe8e-1a81-444f-bb12-71084e2091d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277384, "uuid": "dbff3a99-3844-41e9-b794-9a3859d4bc2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27392342-e746-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767294894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294894, "uuid": "edd4b486-83f2-448e-8c72-97cbdabbd715", "comment": "Malware payload", "value": "fff781f5cb517307caf882a22c418296", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294894, "uuid": "152b75df-4995-4cf4-a39b-a320f6051880", "comment": "Malware payload", "value": "7a01eb15c54198348aab64baead3ccbcd1f3e07d22b0c5c294334c440df92149", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294894, "uuid": "aeca26d8-9395-483d-9f37-e90f0ad5de74", "comment": "Malware payload", "value": "ed669a87a669d1fdaa9ebf8da0a3a4b58c59b5e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294894, "uuid": "15012a02-2f8e-4b04-9099-32c9d3665a20", "comment": "Malware payload", "value": "beddc79d449f30e329fda697b2e5cbe1f89b3c00bc1973416a32cdefee288c7139cfa0807f3dec3bb8a82b2347de2bb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294894, "uuid": "c659d7bd-5fce-46a9-9755-7e8e607aa139", "value": "T1B7B0128F04481080D448FBF49D668F1008459FC234A84E8844F64521CD6D73830B5D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294894, "uuid": "9ae20d55-3649-4bf5-a4b0-50155cb43730", "value": "3:7FY9H6K0NUCz6OWLAgSSKTaGaKzSE/LwWAAqvn:7FY9HM6OWLACKTgusv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294894, "uuid": "98279b7e-afb9-40a7-b531-3c4fccfd06bf", "value": 101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294894, "uuid": "59b09fa0-9dfe-4fc7-97ed-98cd1d8d338a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294894, "uuid": "a9600958-303d-4ef7-bb3e-49958929e53c", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f08ab2-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295450, "uuid": "8b79978e-8e74-4593-8ada-e443d74cf35e", "comment": "Malware payload (Mirai)", "value": "73692b26094f1d10bab8ddc3ee03c54e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295450, "uuid": "a50c8d23-1f46-4557-8e0d-846ad5a07cea", "comment": "Malware payload (Mirai)", "value": "7a243abfc1b2a8abbab517b3b4b1e3b1c8f0816f301c507f81738399facf16d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295450, "uuid": "4fec3f19-b207-42ed-b378-3344eb832812", "comment": "Malware payload (Mirai)", "value": "f8081f808a5344ad73feaf22a1a0a8be19a4bac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295450, "uuid": "1208be96-c37a-415a-a70a-998790e63d49", "comment": "Malware payload (Mirai)", "value": "35c00858ab9d974f25acd63f188887d6c9bec47857a42d4cf55c0f17987f573f78e162f79a135b59107e2ee99d6f6add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295450, "uuid": "1c51f76e-21d7-49bf-92fe-672da2cffa50", "value": "T104B39EDBB74B2490C82286F40BC74BED2E2372019F5B99F72D1D263E59791DB490A3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295450, "uuid": "04bd7afd-18f6-4616-b24f-06270187b492", "value": "1536:g6ozWI3lqggZNzQpb3qoBidhWlzCcvgzpVx1tch9/LWE:IR3lXgZNzQtao8dhWp/vgzpqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295450, "uuid": "2196953d-98b1-4abf-94b4-3b2a36c83a9d", "value": 116068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295450, "uuid": "790db59a-fa15-4be3-a7df-8845d45b2876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295450, "uuid": "d35fb7e2-8b78-4f0c-83b8-79904fea9bab", "value": "goon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd69e74b-e766-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767308889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767308889, "uuid": "3bfddaaa-3de6-4ebe-8b0e-79ce6d93dd12", "comment": "Malware payload (Mirai)", "value": "e6ed19a3fe3b687f944cd4dedca0936d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767308889, "uuid": "0a831daa-653f-477e-9243-fdef2b260296", "comment": "Malware payload (Mirai)", "value": "7a9ce0081d5f59c04ebe768683c28efd03659e8accc55f8be04eda69aed76f74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767308889, "uuid": "3f1b6089-8d81-4ec9-bf10-d7fd9ff7eb01", "comment": "Malware payload (Mirai)", "value": "be3e03cc85ab07ed42528762a524465f4a639609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767308889, "uuid": "d850d330-f95b-4396-90ac-e058e05f5291", "comment": "Malware payload (Mirai)", "value": "bd746a30dc1f4d214362932b4b4028661af9438b28a12ac0c1bb253a688ca68535e66f41591e2b2ed837a108100296c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767308889, "uuid": "4ee67719-6de7-4eb5-bb6f-fd1c84ea37e0", "value": "T1C743D64AB991DB15C5D5517AFE0E528D332307B8E3EE73139E14AF246B8B46B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767308889, "uuid": "fceb7777-3830-4db6-98a8-843e3a096e58", "value": "1536:6hnkLXDq3jcxReswgHweFODnMsF98EA3WM+iEyumkgCu+7R:bLXG3AengHweFObMsjyumkgCu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767308889, "uuid": "9d2d0500-773d-4ff2-bc17-8736073d54eb", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767308889, "uuid": "3d71553e-48ad-4b57-8e09-2710c1d7458f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767308889, "uuid": "58feefea-5b85-4795-a914-ccd31093738d", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe80812-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272091, "uuid": "448ff644-e64f-4fb6-9cbc-4e23d6909031", "comment": "Malware payload (Mirai)", "value": "058dd3cc1897c23476c5cb8d7a24d668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272091, "uuid": "939f2ee5-973a-4e7c-be97-5eebfe33ebf6", "comment": "Malware payload (Mirai)", "value": "7a9e71cc0ccc9dd8b7d03fa13b78b0b1079f98f654031d4a3faf4a5e82316cd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272091, "uuid": "e7246d1b-40a8-4c3d-a4ba-2b709d54edc6", "comment": "Malware payload (Mirai)", "value": "bb98ae19e881525379d54fc4bd536a1218792efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272091, "uuid": "d2fa259c-5cf8-45ed-8030-8abd9ab6dc2f", "comment": "Malware payload (Mirai)", "value": "728892af30139b6ed82515e1fc4d031a2367b7e25c0f6c8e6ff110e592de9143a2ef312da8aa97d8e593f569806e41e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272091, "uuid": "95ba3081-ac6f-464b-a6b8-cc6ba1a58cc7", "value": "T1F17302C43DE815F6ECA352717C0167BABE51844473B932212B399ACABEDF4C383642E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272091, "uuid": "c314b825-7746-4e3b-b58d-aa5198dccd99", "value": "1536:9z0w6/2FHQYC1AtvzKHEP0owd7jc2TrzYMvzWh2T08k3:9z0wiQ8ARzf0rjTYgqh2Y8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272091, "uuid": "3cdb6cd3-4f96-46a5-86bc-0ab7e3e2eade", "value": 80452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272091, "uuid": "4749f5f8-4f7e-4fb3-96ec-5a79aa9cf17f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272091, "uuid": "d0c781e9-538a-49b2-b58f-e77a0849692a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42e0e2c-e718-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767275373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275373, "uuid": "0b15eb5a-a1e5-4761-b2ab-50ebc54d9e54", "comment": "Malware payload (CoinMiner)", "value": "61ead009b8b8b0d904e2f13a08d6a618", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275373, "uuid": "c90befe1-2f63-41a8-9d06-ce10a37d2d94", "comment": "Malware payload (CoinMiner)", "value": "7af6019f2d100511536bfc08ca204871d58331ea7d783f50461120768c4910d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275373, "uuid": "da93f85a-863f-4114-a00b-63d9a08336ad", "comment": "Malware payload (CoinMiner)", "value": "0506e7376692ea5bd94dc6b5af57a554ec825c9a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275373, "uuid": "2a4c6dde-10fb-410f-b9ec-05c635e62562", "comment": "Malware payload (CoinMiner)", "value": "9fef0ea4c2de4b38d2bd150415e7b5bf120f191eeacf07c46075cf1b445c752c55dd551c3622d09e6591235d4328ca6b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275373, "uuid": "63c056be-d812-48cb-b78a-33146e9058ad", "value": "T148C7339923D218D8F97253346663C70467AEB435531CC5DB06E8BB5AFEA3031173AEE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275373, "uuid": "48f8897f-12ba-4a44-9b1d-2723cfe9bc37", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275373, "uuid": "373f854f-7b38-4e26-a525-192cc56bec26", "value": "1572864:aEWE3SCVLl2LaIpzypaz+9H7giZP5dhUfe:aEWERVwhGpa8bgi5xUfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767275373, "uuid": "323b4bf2-0b36-4bc5-93c1-8cd87371af43", "value": 56706859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767275373, "uuid": "42264bd5-1320-4c86-8519-d1dfe0db7503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275373, "uuid": "1bda9601-d2a6-406d-a590-f184a86d2207", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc610323-e74a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767296889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296889, "uuid": "421b2da1-8113-43f2-8541-54a4f18e9326", "comment": "Malware payload (Mirai)", "value": "88f72db12de7e37da1e05fbf28e68077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296889, "uuid": "d6a10ec7-0c55-406a-a580-628ad9a14615", "comment": "Malware payload (Mirai)", "value": "7b1f8ff31a42daf191456151415438f63b6653e594b9eb01ef01e2ebe2b4368f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296889, "uuid": "bf394b98-ff8d-4ca6-a80b-5e731e0f0be4", "comment": "Malware payload (Mirai)", "value": "2bdee3a798f6af091a8deb4042e943dde1ff2f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296889, "uuid": "35d38a12-41f9-4ff9-8fce-6e5318484189", "comment": "Malware payload (Mirai)", "value": "a4e4e7531051be98d456a9f55f4022d79f76918fd1f5a1e831ae9bf75ca83fa716b18a59cd50cfa5a739eba32db243f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296889, "uuid": "4a7d4ac8-bb62-4cf9-993b-55739839df32", "value": "T1A9936DC2A743C8F5ED6612B8653BB3764676E5360039DB8ACB24BC359C26602F72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296889, "uuid": "2dca58cd-df2b-45d9-b4ea-983ccb15d479", "value": "1536:7jnmRtbOxkkt2rQtowKxpeup+WE+EpJx83f0A76LOkv2RW+oiZclShVztT26BymR:XnYOWkIrQaxpefHpJx8cAGLOkuCiZYwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767296889, "uuid": "3be186ca-e0ca-4f9f-9065-841f4c76236a", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767296889, "uuid": "85794320-98b3-4629-a59a-f079312a13dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296889, "uuid": "618a8a0e-b1ed-4e1f-817f-564830cd9acc", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba173b4-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292941, "uuid": "dd137389-390d-404b-90c6-9f573c0c4ea0", "comment": "Malware payload (Mirai)", "value": "cec21ede5d375830f11ed976ae9b5dfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292941, "uuid": "ac3de269-059c-49f6-9ccc-2c1388391e4a", "comment": "Malware payload (Mirai)", "value": "7b347e58a265d0c2fe2788cf64e80f5d95707ae4a5add4ebb9a4aef3f7da1e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292941, "uuid": "f1c83385-6d7f-4120-a492-73e45bc2a3d5", "comment": "Malware payload (Mirai)", "value": "9f42d2c2a3d42128c8671fa75acbb4313fb494c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292941, "uuid": "f6559662-a1cd-41b7-ab96-4aeea3619626", "comment": "Malware payload (Mirai)", "value": "69ae2bc05847d611d1f809db8474be908d7e4d4cd80e811efe06cfa98a72888e0a30603f0d547f11efa7f8b464e7cacd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292941, "uuid": "6ff52485-11c8-4f08-87b8-14cf2ba3e82f", "value": "T146142A42FD518F13C6C622F6F7AE018D37166BAAD1EA7103DD216F6137868DB0D3A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292941, "uuid": "e6a3bc94-40b1-4755-b807-bce836d044a8", "value": "3072:OGN2e5eCEgHMrjcDWtycFucCixpq4U2UVFlkrnqh6hh1RO4omni:OGN2e5eCFlDWFVnnq46V/krq4O4omni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292941, "uuid": "1eec8d2c-a3b0-4d7f-bfa9-08cc78e8a64c", "value": 206256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292941, "uuid": "34c97585-2e2f-42fa-bbd8-3c9ae0a446d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292941, "uuid": "bb2e1cd1-fd4d-443b-a702-3bbdb152b2ce", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f6c36b-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226088, "uuid": "c18a7699-d4e8-49c4-8e88-c305acf43830", "comment": "Malware payload (Mirai)", "value": "df62063eb8c0de5bd3f60607c996d844", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226088, "uuid": "a6957d3e-7811-4954-bb88-2240a2a3838c", "comment": "Malware payload (Mirai)", "value": "7c0f5240e6efb3221c275f3527f81dad54bbec78642d63dcddf7616fe19e9057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226088, "uuid": "03e176d1-5b2e-4768-a15e-f5edb5650f69", "comment": "Malware payload (Mirai)", "value": "d2b03e4913b792a5218bd7d20b92f8d925907b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226088, "uuid": "1f6ed064-4d4e-46bf-add0-1e6906b4f23d", "comment": "Malware payload (Mirai)", "value": "c5842c6ce26566f6e91fc0c8986e9301e04210c28b3d7852b6db2ca524b86c3cd8d354ccd9aeb817d662b8615e450be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226088, "uuid": "7652d75d-34c9-4736-bbb9-f18a3bb0ed1e", "value": "T14F73B505BF614FF7EC5FCC3749B99B08288D950A21A83B367934E418F25B25F5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226088, "uuid": "cca8126f-f452-4cb9-9063-863a64253ff7", "value": "1536:gqzkjaU2zu5h3KFxfH5QukSD6JfB2yOdxaZuaMuM7Rml:gMkmUYu59OxhQgNUrMuM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226088, "uuid": "1be4abf0-8678-4e2a-b5ec-41c22d26a180", "value": 77916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226088, "uuid": "6b104da3-0130-4d07-8d77-30bf7f4a1deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226088, "uuid": "fcc19fbe-cc65-45eb-b6a2-270cf837e540", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ba937-e714-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1767273562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273562, "uuid": "f8bec293-c68b-437a-a493-f5cb3ccfc6a1", "comment": "Malware payload (STRRAT)", "value": "1da632f4225976c702af451afa5ad3fa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273562, "uuid": "2c58ed80-f6b5-453e-aed1-87a97cf75d07", "comment": "Malware payload (STRRAT)", "value": "7d56380b0c8aaf10722c7cbb725f4a02eb548312b23ee4433b0c13919be6692c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273562, "uuid": "74a95b65-d2bf-46d6-b961-ea4615aab687", "comment": "Malware payload (STRRAT)", "value": "e520cf8036f4e2944bd96a5fc04207dccd6b2373", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273562, "uuid": "c69bdc93-7599-4050-9ca0-d465540e635f", "comment": "Malware payload (STRRAT)", "value": "7cac73505867f2bbcc68d07105f3380f58ad0a617ece5f74118cefe5c491faf3668bd411fdfc0a7ad8aea9a43e91c3c1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273562, "uuid": "93cbd870-0922-442e-9d6a-67fd090f1d1a", "value": "T19EE4B687F1208AC7F44FEABE04904310A9F0E4714607F2552B6E885A2FEB9DC9F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273562, "uuid": "88677db3-73c9-49f3-8969-7fc35e7537b8", "value": "6144:FaMa11U1vvykKjW/+nRhvkacQ2QUAUB5Z/kh01eMX5Uh/W94gpr2T8fAPjhMokxh:Lr8RFmdYUBW0R4Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273562, "uuid": "7f1618b6-94a6-4cc5-a7f4-3e570945b8f6", "value": 689235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273562, "uuid": "4a58230a-dae4-41b3-9136-8d3da16ae975", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273562, "uuid": "9642572b-8840-4290-a96e-e868d1e62d16", "value": "Radium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be12136-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295438, "uuid": "fae55915-e96a-483b-9306-27b6831e5a06", "comment": "Malware payload (Mirai)", "value": "6a8988d57a253def0c1940814e6a9f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295438, "uuid": "b3229028-3ba0-45ba-8bee-ed608cf6651c", "comment": "Malware payload (Mirai)", "value": "7d800d51cd831e5abf0acff099bd6ede4ce79e211fb57e823249afeb6fa8ddb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295438, "uuid": "ee4fc3fc-7443-4b39-956f-3865cc005b84", "comment": "Malware payload (Mirai)", "value": "91e935dd4823401b7fc947f6c6e54f3e06886ff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295438, "uuid": "31ea76b9-87e9-48e3-bf56-e44afb086687", "comment": "Malware payload (Mirai)", "value": "5fa28f3d46eabd59422ef6653f83e8ff5532be4f94f5b0547d63117c02e075d4ca15efecc4bbc63361f75952b623418a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295438, "uuid": "a5e1b666-4ed3-43e4-82e8-900cd3b85597", "value": "T148535B1BF58180FDC18AC17817AA723EF97371BD0339F2BA53D4EA162D56D618E2E504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295438, "uuid": "6ff7e4c2-ffae-4f1c-8f4a-a8b5136c6ed7", "value": "1536:U5/JwFwZrT64urS02dimxxW3Mm+6kOYcG0cw6+AutWy4w:+JwFwB64u32dicm+6lG0pSutWy4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295438, "uuid": "268487ea-8b47-4f52-945d-3564c89484c9", "value": 62304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295438, "uuid": "727ef130-bac0-4923-97e7-1f69791ba63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295438, "uuid": "04e68213-e36e-4a45-8b75-51f6f66866d1", "value": "goon.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51813b25-e759-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767303125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303125, "uuid": "470b29b7-850b-4bdb-8f5d-87a49c12d864", "comment": "Malware payload (Mirai)", "value": "f3cc76ea17a84f53f7f4146e50bc68dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303125, "uuid": "6525e690-8fa6-4902-b583-498d4eb4564d", "comment": "Malware payload (Mirai)", "value": "7dfef144deab6b4e4458ffe05c290af1bf2f24831b7cc49be747d6de0fb12c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303125, "uuid": "56f60313-023d-43de-aaa0-4ac98d02434a", "comment": "Malware payload (Mirai)", "value": "d4434dcfa01c1bab36ce7f938e214932cc17777c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303125, "uuid": "7cd4ffd2-1e0c-4ef4-8272-85626dd3afcc", "comment": "Malware payload (Mirai)", "value": "d8b4543c44d1a99c4c6c98b7e8260f1dfc7dc67e9684b0a6fa9d95b9e06535dedc6a96ab0052464f961ef3810025d9e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303125, "uuid": "70f3acaa-c417-4dac-a7ee-f28dc0471b74", "value": "T193530945BC81DA27C6D462BBFA1E42CC332653E8E1EE7207DD116F15778A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303125, "uuid": "d533e415-7148-4da6-a770-3c920dc72ee4", "value": "768:89B/+6GJcTlMhv7p9qS+F1WarnKIC6Mcex7evhmNdQxVBiko696ocu+7R:6/7Gj9qnrprnSye9KcQ88Mu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767303125, "uuid": "226736b8-2b15-4932-ab14-f67da5a70f96", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767303125, "uuid": "a70dd5e4-5f0a-4bf8-94ed-a76c59b7438a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303125, "uuid": "004e8f98-5a37-40d3-95d4-1e3bdc6b4531", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cec890-e748-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295990, "uuid": "d91c0089-ab09-4a4c-9bf1-edbb9db9cb46", "comment": "Malware payload (Mirai)", "value": "8dcd7876655002d2e0aaf2382cc3af26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295990, "uuid": "af7b1dad-5605-4aff-9776-401a2d1d36d7", "comment": "Malware payload (Mirai)", "value": "7e1a5c16951974c30f775b557b8e69d5230e647f3acee190cf5b9b48047b48e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295990, "uuid": "18f1a8bd-f2b5-434a-947c-d6b43b8a9f9f", "comment": "Malware payload (Mirai)", "value": "e87107a5b0a8b74959a0d181925acacdeb278d5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295990, "uuid": "c0ea436c-7324-4b37-8275-3d83d3e4683d", "comment": "Malware payload (Mirai)", "value": "6fbadfb8d79871cf05d3508f64802b6aec69fe95a00743d24ddde64f500c38b525bc2871b2773a5a6c94e8ca65f5764d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295990, "uuid": "4dac9a1a-58b9-4e73-b595-9c40092a0a39", "value": "T1C2D3A30E2E228F7DF768C33487F74E35975963D622E1C285D1ACE5111E6434EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295990, "uuid": "8620dae4-2328-4bd4-af03-472b5788a837", "value": "3072:mSU+BxV9+afqeDn4SKPsO/WMHksbDbXJGL+QEu:mSU+Bxzj5DdO/W2f5uEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295990, "uuid": "58cf2d40-fec7-447f-9889-cf15a00dabe4", "value": 138600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295990, "uuid": "97f2c501-9baa-40c4-90d5-92cc0a8a6fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295990, "uuid": "cd6a1020-6df4-49ce-bc60-37d8605dcd66", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dc882b-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295435, "uuid": "3d377c4e-05b2-4854-9b1b-45d4f5cdb5d5", "comment": "Malware payload (Mirai)", "value": "1324b1873a659a843cbc09c458a1b340", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295435, "uuid": "db6e17c3-f6df-4ada-b0d2-f2e22d6b0cd9", "comment": "Malware payload (Mirai)", "value": "7ecd7f660a2ce49bccb6a14d211b2864783f1839942ef9856eb3025f4c6c5c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295435, "uuid": "ba18faf1-2bd0-4e18-a9fb-2b05938cdcbd", "comment": "Malware payload (Mirai)", "value": "81b09e77ae251e4fe1864b5191c25f53d767afb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295435, "uuid": "f58506f9-2f21-441b-976d-1108545a35ef", "comment": "Malware payload (Mirai)", "value": "df40b798229ccecf28029267f5eeadba39d2181a9f4acd89bfdc97705ad3c1d389f42868c05416549b181b6d1b93c48d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295435, "uuid": "159186a5-4b4d-4b98-b88a-929312092c25", "value": "T121735A07B58080FDC59AC1784B6FB33FD972B06D0239B2EA77E0EA176D89E215E1E514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295435, "uuid": "13dfcacd-eac8-45fe-9a09-53602ae9d8d4", "value": "1536:MB4oCVqtPIm/xp5LgeD4x3fGXCSGYz2uBiBrAw2y7b1T1TT8S4QOAm+4ENT3SP:3TVuwm/hUsA3eXWYz2wYAw2u1T1TTvkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295435, "uuid": "32af90bf-139d-418b-a0d3-a7e79880d6a9", "value": 78736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295435, "uuid": "6ea89e9a-16e3-4886-8a62-6d4e23a2147a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295435, "uuid": "6346c188-cd94-48b7-b189-7778a1457565", "value": "goon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9899fe1e-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228512, "uuid": "7f192f76-5e1e-4c0f-8b19-5aad6ff2ae66", "comment": "Malware payload (Mirai)", "value": "24d551ca2fe6d97b91e484e58abc6caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228512, "uuid": "39ec9ec3-7cf8-43c7-86cf-3928f9cd7e47", "comment": "Malware payload (Mirai)", "value": "7fa081add427866a826902c8689227c14067c9d3f40a2f5a57db31b3c51450c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228512, "uuid": "73c30d9b-eee9-41a7-87dd-a6351cc0dd31", "comment": "Malware payload (Mirai)", "value": "31261c16f966b2045088cdb7d6f8766374302c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228512, "uuid": "ef7beb99-94ad-43ee-b92e-5b3bb59a7369", "comment": "Malware payload (Mirai)", "value": "76251bb7cccf1557473c90f01114c9f9a0f3b1a5087acd21518b60f6ae0733862a38c6b954ef4e2d97b5b2f2a673ba22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228512, "uuid": "67ed6586-b6cd-4855-bb90-354681d142bc", "value": "T187F37EC5E683C0F5ED52067110B7BB369A73E53F203BDA82E3B95A31DC51A41C61A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228512, "uuid": "4b0c10b2-47cd-48d9-a7fb-130a07e62850", "value": "3072:bMtR0LBXOg6e7+eaxzskSs5uKAO7Vwf/5SrW3b9fO/cPNgdhGB1JeZgio:YtoBXBVaeaAs5uKAOA35WkPNgmeZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228512, "uuid": "3b43984d-5169-46f7-95f7-0cb72b8b5001", "value": 167024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228512, "uuid": "0383f730-2d7f-4b29-bfc9-a2ed471e8dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228512, "uuid": "9a277a10-d038-4f2c-8401-6272dac03a14", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10991171-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272092, "uuid": "5b85af0b-2c94-453c-bc12-aa41c028c61a", "comment": "Malware payload (Mirai)", "value": "b730ca04e2728b73096b7745792fd4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272092, "uuid": "35a19062-2aa6-428c-aaf4-9c25c64d93dc", "comment": "Malware payload (Mirai)", "value": "7fdbc8c99b1144ab5284a09aea9586837d5e3c35a433e63d25b9c087d0dd4359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272092, "uuid": "7842e19e-13b1-4372-9045-db675b3a56aa", "comment": "Malware payload (Mirai)", "value": "9de018918923cfce6499bf488b0c9fca8521b7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272092, "uuid": "ac63b2f1-1deb-4e73-b443-14e1dc8c3e1e", "comment": "Malware payload (Mirai)", "value": "b973fe21650362bc39f609f56f280109f72fa627c97ab4487f0eab9e71b593704bbce31a3cdc97679b2b924385021529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272092, "uuid": "efbedc12-4b3b-42c6-9115-a1a1f396e584", "value": "T111047DD2BA5E7D7BD2634E3FC64243556F3CAF008E02251760AE728B29BB1D10F5674A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272092, "uuid": "f5927abc-3c74-4ccb-9a52-2830d7e58f4b", "value": "3072:FXBpLiW5GSHS/Vf6Hs7pyTkvBL14/Vto+4ZYGYrAeLfzw:gWJIVCHap/vBLS/VipZYXAe7zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272092, "uuid": "5884fbcb-a9e4-4932-bb00-1b5c6bbb7cc1", "value": 183940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272092, "uuid": "6b790792-4e81-46a1-ba0d-505f75028122", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272092, "uuid": "49e57ef6-488e-4d94-9f43-54e57b1afcc0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c88338-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304573, "uuid": "dd1bd676-e1fa-4aec-bffc-0979871e700e", "comment": "Malware payload", "value": "b4bc7b8bdec6dfc23de74e2c224b9c2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304573, "uuid": "204a1582-03df-4a31-a3e8-345a59505a5a", "comment": "Malware payload", "value": "80188044b0c4e83cbbcee1d5ed7c9afa08a77f4caadb377148f56b8061ef80d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304573, "uuid": "c1a9df5f-4dac-4a31-bf9f-af9156eac709", "comment": "Malware payload", "value": "84c44289fea505818edadee3aa196249906a2f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304573, "uuid": "d0444a6b-09c0-436f-88cd-8431d50d4a53", "comment": "Malware payload", "value": "b3387e7281b59fddc82570f19a46b17c92c8d214629e531f8414318add6536bb87199413e6961834acd26b035e6b02a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304573, "uuid": "15d3fb79-2690-4abf-b2ba-10a7b81140e4", "value": "T1F1461887B9D24942C4E4367BBCBE81C433631EBA9B8652576D05FE383ABE5D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304573, "uuid": "c8562573-c1fd-45af-aae9-62d5abaa6599", "value": "49152:gEdTMDjtCmpYxhuOh6ylUw0Zs8KIeUW325Ev:dGXt7YxhuUl6XeUxEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304573, "uuid": "dac80313-d6e6-459a-a618-2e39506ab8df", "value": 5832888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304573, "uuid": "83b5b288-a00a-4d13-a6ee-bac7c8bdb54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304573, "uuid": "51330b17-c43b-4603-bb04-20306a643b30", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e87bf3a-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226992, "uuid": "22dd1484-0112-45c3-8e5b-bae8a4d1d474", "comment": "Malware payload (Mirai)", "value": "9c7120f7b7210be902482348a5ab7de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226992, "uuid": "bf6ba4e0-0cd9-4495-9bb2-1bb9a610f774", "comment": "Malware payload (Mirai)", "value": "80527aadc0101c359a3681060c3b9dff483b8aaaf3521f811f73e949bb7eb163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226992, "uuid": "9202db50-2eb8-493f-9050-65b5669c6788", "comment": "Malware payload (Mirai)", "value": "dc57863caa320a9fb47180573700ab2a357067b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226992, "uuid": "c9efb376-cefb-4a3a-a5e4-14acf49b79d4", "comment": "Malware payload (Mirai)", "value": "fdbca5576f17160a3aa7c49790c2cf69e6cad50627929c2d8e37f57d73d8ed5fb8267f828ce238645217925e5437d98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226992, "uuid": "ce695998-0137-40bc-bd00-3edc2b92ba11", "value": "T1FDC32A95B852AA12C7C246BBFE4F428D37165398E3EE3203CD155F6437CB95B0E3A246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226992, "uuid": "ef7f568f-0a39-48d1-befa-fd82bf625d19", "value": "3072:me/LjUPow5rM6/wGvxsNlzbJbrpT5jltbCbxK0tnT4:meMPbt/5vxsNlHJb1T5jltWbo0d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226992, "uuid": "00a13039-7607-490a-82b9-11d2b48077c2", "value": 124696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226992, "uuid": "b56333c9-d2ec-487f-be24-836a1fa145b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226992, "uuid": "79c517f3-052a-4891-8503-8f2e0c53fc67", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4d5583-e76d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767311790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311790, "uuid": "97dd6d8d-27df-4d4e-b32f-8b9ed4d1c10f", "comment": "Malware payload", "value": "257ff7c4c629f787b9fe5bab3ec4dcf2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311790, "uuid": "4297241c-789d-45bf-8874-156c71812fc8", "comment": "Malware payload", "value": "80d1b1df70fcc7d0e6410db92a98e859f677a128d530c1135f38e3f18c6cc153", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311790, "uuid": "12c9099e-2e00-4e6f-af95-066f035b9f3f", "comment": "Malware payload", "value": "51d4d6265aa9d7c3ecd416cfd28d838f6731b3b3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767311790, "uuid": "6cf56686-1f22-43aa-948a-9b4174f3ad41", "comment": "Malware payload", "value": "63ff4b78810a696b804bfbddbf535b3f4d672d07635695bf35943d2d60ca19d21290651a08ca57543f86422ada23c3e0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311790, "uuid": "1758419b-78ff-4279-b751-8244d4c6d51a", "value": "T1D2C63AD2EE544329C6DBD73AD9B152456230B045533212D7BFA9076A8D0BBC8273FB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311790, "uuid": "add17451-8add-4621-8304-b45b07d1c45b", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311790, "uuid": "d649de11-8e40-4d2c-93d7-91d8409c6aa6", "value": "49152:0Gowvt5Grb/TQvO90dL3BmAFd4A64nsfJJjgjTV2iuv5HYldzN6ZHBi9oggPAdtZ:0GBCZcdtoDQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767311790, "uuid": "b0b0ba80-1669-4b67-bad1-bdd20b1378ee", "value": 12068480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767311790, "uuid": "c159919f-5a92-40d3-9889-5b6d1fe1dc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767311790, "uuid": "03a9057a-d67f-4334-a019-92013c80dfbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5122491e-e6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253303, "uuid": "5bb252cf-cf7c-46d3-82fa-733b16c79dad", "comment": "Malware payload (Mirai)", "value": "bc98130701b1c5e0130825fd60e0c2cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253303, "uuid": "c9200583-2dfd-43f0-83b5-23efc49994f8", "comment": "Malware payload (Mirai)", "value": "826981eef0c71c0be37880ea6a078ca9792d655bd49e23a9f3ac4f62bf6f0e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253303, "uuid": "7736ac09-3026-436e-b646-28b20f3c9bbe", "comment": "Malware payload (Mirai)", "value": "d8ec1fd1820e7ffeb186fcc033c0f145dde3de6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253303, "uuid": "f758664b-1d90-44dc-9337-c1d4a9fb8454", "comment": "Malware payload (Mirai)", "value": "353a8f7b07fa52d10d124b0d6f0245fd2f095cd1a7a608061f7630774de4ae6523c136315ed68d3922edb6152db912b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253303, "uuid": "c1f1fd97-11e1-449a-9fb8-5fa563e51741", "value": "T1FC03F1B16231C874C670943DECE60ED17A49897CC0BBF1527F78864888F95D2AEB91C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253303, "uuid": "30e48bb8-bbfd-46aa-a35a-b11945d7c64a", "value": "768:wMNvmcGeburFwuASaN4mi2/cARQq/z/5tv9q3UELIj:wjZcqNASaLsq/z/5teLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253303, "uuid": "53220cf5-1cd2-4512-beab-dab674f7554a", "value": 37860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253303, "uuid": "42549b5f-4bef-44e4-8c85-7ededa8c3fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253303, "uuid": "ad6e5384-c8c6-4337-9657-8eb63f8272c8", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0d067b-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767280113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280113, "uuid": "88d5cc34-038b-4c36-9bad-0cbba62ff432", "comment": "Malware payload (GCleaner)", "value": "536de3080ef2c84b0fb55dc440f243ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280113, "uuid": "6334fc8f-1b42-40b8-bbe4-070cc1468e85", "comment": "Malware payload (GCleaner)", "value": "83a83bbf48d39d04352230bff227366ad122c825ff5ddfe30b3ebd98c834c7b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280113, "uuid": "86d0e538-4068-4630-a06f-324e4387441f", "comment": "Malware payload (GCleaner)", "value": "8e334d4343c880776463ab752ec4668650c21797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280113, "uuid": "af5bd422-fe5e-4f38-9b76-2a247d585d63", "comment": "Malware payload (GCleaner)", "value": "707b27719bcf11f79e9acf61e9cc8e72ba4de571db439c5b919fad0ccc4c6df89287072e19f029a103af8538d0e012cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280113, "uuid": "1b89a46a-b93e-4130-8bae-9189fae79e0c", "value": "T15FE39E117193C0B2D17209350864BBA58A7D7D203BA1ADBB77E81A2E1F703E4A673D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280113, "uuid": "bc74d85c-cf3c-4ea3-b28d-c7929af62e8b", "value": "19abccfc67f3c5c9ee1339049bce8639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280113, "uuid": "a2400761-60cf-4ce7-966a-03067c794133", "value": "3072:vzp+KYjQ9pTL20Hng9Xd2qXXNCq7rsor0BJUzt7UrqYmZeOf9HyH59bI5LOFN+0R:vzp+09pT7ng9Xd2qXXNCq7rsor0BJUzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280113, "uuid": "0dafab86-928a-4d6b-a4c5-c2743e65aaf1", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280113, "uuid": "0696eab2-dc62-459a-91ee-f296fed2aefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280113, "uuid": "e6eb8102-91c5-43df-a4ae-6e20435dcf48", "value": "invp7k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0a5ff8-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233297, "uuid": "46571b48-abe6-4503-acd2-020680d9c5ab", "comment": "Malware payload (Mirai)", "value": "752c10ed882d225596adf741c7ec541a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233297, "uuid": "23cfaec4-e47c-4b31-bcca-482d817ef38f", "comment": "Malware payload (Mirai)", "value": "83c5244db28fa88abdb95932dd6ce656dec4f769f956c129d3ef70cd0f3c1288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233297, "uuid": "11f01999-e10e-4b10-9cab-c6eb491d4272", "comment": "Malware payload (Mirai)", "value": "1fad67756727398b5a70841ed7d91d7918275e9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233297, "uuid": "7b51f445-bfda-4e84-8040-1fc8b1773a32", "comment": "Malware payload (Mirai)", "value": "eb6cfc6164c4dfd60594c7cf8e79942f87bb9940b0b6cdfe898545a8b3f4d7e822fddeb8f8c9b1b850773bdf3ba06859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233297, "uuid": "5ea6c0f3-d3c2-4f56-85a2-41a0fde6c9a3", "value": "T13B4302E06DB238A7EF75C83573B041C93A2515F2FAE6A5371EB4047809A359F3FA1842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233297, "uuid": "d4fac101-282d-46f3-8fc8-0f28af95c34d", "value": "1536:1TR9Bs/K6BXx/E/kP4Dtn1WcVlXViWtg864LZ:UCWxE/okjPkorlLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233297, "uuid": "3e82e2f9-f43c-4e14-a965-ce88f747c844", "value": 58996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233297, "uuid": "f2b96bf9-170d-4a56-83c2-4a6991eb10a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233297, "uuid": "aec162f2-bc95-41ff-b68a-e4de8b09ec11", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd71b988-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767283120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283120, "uuid": "486f58dc-b91f-4deb-938b-bad5fd1706f8", "comment": "Malware payload (Vidar)", "value": "7837ca0ff12e18145d5d57d04633d50d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283120, "uuid": "1622f078-ba9d-4e74-adbd-fcc730cf36c2", "comment": "Malware payload (Vidar)", "value": "8526504c3d664f2f8d1fb8f3bf5003c2e616c875c4d9754e3c7b499921d46734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283120, "uuid": "46c06c7f-0519-4aaa-9755-5f110e4b5cc6", "comment": "Malware payload (Vidar)", "value": "b1f7b2f5c83133d3b78c0af2d9c8991e0adf3d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283120, "uuid": "fd24a975-e504-4d75-9be7-d695f7dd0ca4", "comment": "Malware payload (Vidar)", "value": "e60f89f231ac963298552fea435dbea512e47647d8cf33f284840878607232f344801beda8f5c81615df1031b7e78960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283120, "uuid": "e498d7a8-7cbf-4421-8905-c4159f5368a5", "value": "T1BC564A92FD816659C25BD238DCB5615533307884033813DBAF6347B84DEBAD49E3BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283120, "uuid": "edc1a901-dc5d-45fd-a218-df26bcc6ff00", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283120, "uuid": "48267617-79f1-47b1-ad43-b3571cf9972d", "value": "49152:9tiSlherb/TsvO90dL3BmAFd4A64nsfJOkEFmwSzLSRpKkMOY4mK1frj+MgBGPFX:9tBR7h8GpDVx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283120, "uuid": "c1b994e1-78c5-471d-952e-0e76895f8fdd", "value": 6302848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283120, "uuid": "41628dc5-b308-4d36-a606-f11c4ce96386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283120, "uuid": "55cae309-32a7-4677-a3b7-2fbe916a6e17", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20db69d-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "a2b74a50-5081-4d69-bdcc-0dbdd9f346fb", "comment": "Malware payload (Mirai)", "value": "2a599cb58bf587df22c499436016863d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "7c7de2d2-aefd-42f8-bf9d-05c7ec307232", "comment": "Malware payload (Mirai)", "value": "8664a512807f9d50a0d85f03c0189db7650db62a35b196c85a713280e65c7fe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "b50e1a2f-188a-4120-b7c5-4c2d4271d3e6", "comment": "Malware payload (Mirai)", "value": "613161fa4698c8ccd87f15be6ccebdc04ecd873c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "1ffd3a8e-a1b3-4819-bc78-7f873f90fec1", "comment": "Malware payload (Mirai)", "value": "53ae691d18c74f2c3e8f5d7624837229ddaf5449707fc307c202d22fb5e1664aa665f1ae0d74a182fa893cf0202723da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "bd4bb323-cda0-4ec4-a828-6cee50340870", "value": "T128730235007BD0649DE11C756AFCE8803DC86BFCF4B3629B215965844AAF0666EECAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "2fbf3637-f9ea-4951-9231-8bfa9098569b", "value": "1536:vaB3vs81Eq1oWebZpQU9fk6Reb3ePtGqD6LhDRffOLTe8J2Lx:YUsleFpQU986Reje1n4hDRfgTee2Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226085, "uuid": "8b6c39e8-df10-4486-9d9c-806adc1b9e04", "value": 78720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226085, "uuid": "70b3d857-1fe4-41cb-866c-d899e752a257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "f32995d0-c4d5-4ce3-9f5e-3841c9c1c658", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab08416b-e6db-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767249159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249159, "uuid": "02509cd4-fa09-413f-8a45-38ef50270f85", "comment": "Malware payload", "value": "e9c37e4feccf6f320aa3ea5183975141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249159, "uuid": "6e9b5be0-733c-4f65-a488-e4586fc4bb4a", "comment": "Malware payload", "value": "8675346f9e1c51b420b0220d2e058d0329cd8c180448535db94fe85d932a2c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249159, "uuid": "0e371a05-1b56-4533-bec1-ceffec45ebe3", "comment": "Malware payload", "value": "4033597e5b2c3b8e7268beda79b73e9a7d07be75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249159, "uuid": "db7b5adc-66aa-46d2-9d25-3bf4f5ee23ed", "comment": "Malware payload", "value": "e8f846afd390c8dfbf72ff503ddab3c76ae86904cce042f898ec71adea86a6fa2e2a40d0324e857cd2488d1fc8f719b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249159, "uuid": "175dcfd8-f50a-42c9-ac94-7f98e6e5d9a9", "value": "T13FE4A022F6D14837D1B32A355C6F52699C3ABF007E28B94A67E91C4C4F393913E292D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249159, "uuid": "f3b87d96-3492-4232-a5e1-ef88d2105051", "value": "7a84276b96c31a84abae28b74ab371aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249159, "uuid": "cf7580f4-24c5-4411-8400-860383c51ebc", "value": "12288:ieQLUVQl2UEcTcs3wIAdJR8V2n864AeG7LYjc5/n7l:i/oSJlT/A7H8oyTxY5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767249159, "uuid": "06d3d090-dbb8-4628-b49e-15d8fbad1978", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767249159, "uuid": "f08330a7-856a-4196-a24f-6b8a60d71f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249159, "uuid": "50763aeb-cfe4-4154-b6af-281e91c289b4", "value": "ChristmasSnowGlobe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94018323-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225927, "uuid": "c33b1b73-e29f-41f6-9bb4-b4b738158d80", "comment": "Malware payload (Mirai)", "value": "3eba80ed9608e064528d636e52de40fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225927, "uuid": "8c401062-1218-4b6b-a989-782dc7e593ac", "comment": "Malware payload (Mirai)", "value": "869cb67f3af97e4b556f3a2e58b03ee0fdedc9c185e5872a3b71e70477db0a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225927, "uuid": "3f9b4c67-e678-41de-9e2d-b05a7bf46e21", "comment": "Malware payload (Mirai)", "value": "d99bded680c2037698124131c167c3369c4d974f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225927, "uuid": "ecb899ad-f7fd-4612-a33d-18b0af267033", "comment": "Malware payload (Mirai)", "value": "72cde7d30e993e4094a09ef2cecfe5feca8d144e3906c9f0d6a5afe06bc9c6afcb3b2f2ba288c9aabd72e0a7dc5c08c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225927, "uuid": "ac3d80e0-7cad-4e5d-a82d-6991882f1013", "value": "T1C044D40AAF610EFBE8ABCE3306E91B0128CD641721A97B757634D518F54E64F1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225927, "uuid": "868cb957-6c9d-4030-9572-d5adc50360fe", "value": "6144:daCbZdpil7ZKfpguXjwkB2CSZX2sn0gA8P0pR:daCbz6YjckBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225927, "uuid": "f1e8bca6-48b1-4c5e-a2f0-65943a717906", "value": 270208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225927, "uuid": "38c6c1e1-905b-4a3f-bb01-8c6e0f7593b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225927, "uuid": "fe913098-6e12-42b0-9b0e-3a2ac7837890", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703a9a9d-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295446, "uuid": "40610d5e-ce5b-4c74-ba91-04d322a335ba", "comment": "Malware payload (Mirai)", "value": "77d8368482cf33928db1820760a47adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295446, "uuid": "325187d9-12c2-454e-b13e-e6fc11d8ca6a", "comment": "Malware payload (Mirai)", "value": "874c119331427285b5d9e8c2a8774974b04510815cdc574b9a3bc803f1cdc025", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295446, "uuid": "33bf738f-59e3-4395-88a7-6f40232f852c", "comment": "Malware payload (Mirai)", "value": "876f6a4ec01780564e6f472ab35f95772ed7b4e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295446, "uuid": "5db09c87-7400-4f7e-a6be-11e8a45b6f15", "comment": "Malware payload (Mirai)", "value": "fde4944aaa8bfe7e0146cef409f82a04f16e449a3daf9810f1eb119ac36457d39a2eeba38eedb468c6eb751eb9ab1a3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295446, "uuid": "a225a2a0-5711-4c87-bdec-df079295fd1a", "value": "T115831885B8829613C6C552BBFB6F428D371A17B8D3EE72038E255F20778792B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295446, "uuid": "ef5c0f41-7fa9-4849-be5c-f749e98e65ed", "value": "1536:MVp18Awyvwc46jDConDTgBWrV22lTvaacl8XSfSum+CgZrj67:wp1+CjDConDTgojjaDl8X82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295446, "uuid": "c45e3386-5c70-446a-a933-6132aa774f9f", "value": 87444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295446, "uuid": "c660623e-9874-44e6-bfea-c01ddc9d8e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295446, "uuid": "35c7f307-ecab-439b-874d-1ed13afb8fa7", "value": "goon.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f687bb97-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293094, "uuid": "4dff8ecf-e3ea-484e-8bd0-c2f4a079f779", "comment": "Malware payload (Mirai)", "value": "bbda31d5cd540cc642306e00e4a6f235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293094, "uuid": "31e6e643-84e4-465a-9bb2-942a773e886e", "comment": "Malware payload (Mirai)", "value": "87c24fd083fba2e6dafab0a4ca37e72fe2d411ac3645ca65b03e1b71a8beba06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293094, "uuid": "61d895e5-8712-4589-983c-f1209c9ea5cf", "comment": "Malware payload (Mirai)", "value": "72cc7302cc620515358f2c65a4a2dc1593076d39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293094, "uuid": "602a7cee-4a2f-434a-8590-260bba86efbd", "comment": "Malware payload (Mirai)", "value": "8fce916b542e988497ad3e3e731f5e3f91dbfcfd9a09c0e9024c05fee4624389a94b47a23e2350de8ef3f0179b30a1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293094, "uuid": "6d9f6dab-5045-40fd-8535-ba15cfdcf4a1", "value": "T122049C73DC656E98DA64D1B4B0E59E390B13902554436FFBA9A3C2B28047ECCF509BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293094, "uuid": "a9b80863-477d-4671-a5a4-fd20c5f6b5f6", "value": "3072:H1kI51kuiIkmGtj111iESRM0Q6YRoSY+WTkT2+b6hh1jR/:Hd1yIRUp1zSRMIYSrTF+s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293094, "uuid": "579fef09-75cf-4da2-bb49-3c3fb482afed", "value": 181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293094, "uuid": "347b03bc-482f-492f-827f-a65683b6ec72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293094, "uuid": "68f88935-ad5e-4c09-a049-0c3f949a5456", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018ba53b-e732-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767286240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286240, "uuid": "ac8944d9-d837-4402-9e44-8b22fe23b001", "comment": "Malware payload", "value": "6c755a00ec68fc7c6f93a04acda2f7f8", "object_relation": "md5", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286240, "uuid": "16c1e050-133b-4853-a8ac-d2595bc40a67", "comment": "Malware payload", "value": "88a450a634f7393f6053d42df1575afbf82b3e8c7bb7f62dfc9aadcb7b93c94f", "object_relation": "sha256", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286240, "uuid": "d284fe8b-ae7b-4531-98cc-0bf90debf04e", "comment": "Malware payload", "value": "0f7ba6c2a6999a81cf5e5ceba22ebf02c96c5dac", "object_relation": "sha1", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767286240, "uuid": "bdc5e194-ad77-4d40-8fe5-bbb62848d93d", "comment": "Malware payload", "value": "ec81e83ec7efbf59dd50332102a7f50654ac6641cf1e298d46ff1aef93f77c09f75d06424109b1e402b60c9c92aa5387", "object_relation": "sha3-384", "Tag": [ { "name": "ChromeExtension", "colour": "#0F8CB8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286240, "uuid": "debed00c-7609-457b-a05a-37ee234cdc19", "value": "T15E06332A8325D3D3C6E13AB7A4953002ECB355F5A59CF622374BCD24B1E4F8F72A9161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286240, "uuid": "5494dca3-3cec-4f29-91d3-55cbd0447918", "value": "98304:r5SP+RPtymxauwP9nnfhXS3g1+evvbrh82S+kQN5CXsrOfN:r5SWpYuwl5mg1+ev3tSXQN5gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767286240, "uuid": "74fa27aa-7413-4996-aba2-89f2e9af2cf8", "value": 3955574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767286240, "uuid": "9c2760e5-6cbf-42dc-ab07-4d955d810aee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767286240, "uuid": "98704aa1-cddf-4b4f-811b-4d023bacd313", "value": "RoProPatched.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e48c01f-e6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1767234507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234507, "uuid": "8d3e0b54-5fb5-4140-94cc-0994b915d89d", "comment": "Malware payload (ParallaxRAT)", "value": "5f51c97f8cf494d851ebcf011b435010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234507, "uuid": "db6cc9ff-dc42-4f7f-b93a-60558a853c53", "comment": "Malware payload (ParallaxRAT)", "value": "88d74009c9ca46363e02b9121de1cb32ef18d4ad301414a935767bce93c98897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234507, "uuid": "4068ffb6-5b89-4873-b265-d97d7f67f59f", "comment": "Malware payload (ParallaxRAT)", "value": "ee6fedbccfacb0e3c598629fbd67ca71a0ed4059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234507, "uuid": "dd8871b5-aa84-424f-9e9f-7d0febccfe78", "comment": "Malware payload (ParallaxRAT)", "value": "4e07ae57ea3404664eaae5929b4e6d4261c61226d295957db63aba04465c2db7e07acc86e8e196b645f4bd2f6d3a9f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234507, "uuid": "3271956c-c946-4852-9cb4-a55f28a3ae72", "value": "T1FDF4CF4DB28E82E3D4C00C38D7A373111714BD7F5675D49BB1886B68DCED2A4DE89A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234507, "uuid": "57b66585-17d1-43b6-ac02-5c5a6d574cab", "value": "151cb684d328118cbcb29c80e832621c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234507, "uuid": "0d4e3c5c-ab3b-4592-b493-6e4b32be3e1b", "value": "12288:ZEY+DE3pRg7fMV6KS3DVpRUKf3Lu2Vg+Kl4Qrg+OL9ogyRO:RH3zg7fxdUKf3Lu2VgV4b+E9ogeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767234507, "uuid": "051979c5-eca2-42a3-9038-9a368ab5d356", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767234507, "uuid": "24d68112-7d22-4283-962a-89e658d68d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234507, "uuid": "7fa949a3-2d34-4a24-9357-ee41ca248c36", "value": "SecuriteInfo.com.Variant.Application.Babar.35877.10526.27767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2e6921-e72f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767285216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285216, "uuid": "95d3defd-fb0f-48fb-aba8-b73fbe4e5f92", "comment": "Malware payload", "value": "1d2a0e05cb11929794de1616de18a3d9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285216, "uuid": "a16aeafa-2f1f-4fde-8171-b888e30ad0e0", "comment": "Malware payload", "value": "88e17ed83fc6afc0eceb6840ca5e376696eb4c44c58188a02f3fbbcad8597deb", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285216, "uuid": "a1a10003-c13a-407c-9636-1c08efbff6b4", "comment": "Malware payload", "value": "bdce849074cf043d74f7535ddd296fac5b52f622", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767285216, "uuid": "9e20a912-0bf4-4c4c-bedb-56e01a84e2e5", "comment": "Malware payload", "value": "f4ea9eaff843d98d4f5ebf3b653397c03f5d9e19aeffa7d8b16ad8ef5d667ae5c5a3b1432eaefd7266580f65922c0643", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285216, "uuid": "441dd88a-5064-4a23-98dc-75b39fba6c6a", "value": "T14D978B0773E60195E9B3D2788AAB5103D773B8625730CBDF329D06552FAB6D09A3B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285216, "uuid": "1a2a64f8-7903-4fa7-97af-96dd56549784", "value": "bfdf360405e2a60f93db21d6a40d07ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285216, "uuid": "84cbfc7a-237b-4eae-b59c-4ac45c280372", "value": "393216:M6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4SXr3/hIxe:M9HlkOm6VXdIxO1Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767285216, "uuid": "811bb4ec-b3e8-4171-8669-50469fd8fc5d", "value": 42618368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767285216, "uuid": "58e53e9f-09bb-4a9a-aa5a-59cf3b2a20a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767285216, "uuid": "b008bc24-be1a-4dc9-aae4-89d559262d26", "value": "Flex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b5033-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297798, "uuid": "3df48625-a4a6-4237-97b9-7053e063bdb7", "comment": "Malware payload", "value": "cb97bda610cc96352f3be504262988fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297798, "uuid": "09de6e86-138c-4244-8adb-fb89123c4a67", "comment": "Malware payload", "value": "89e89df7465162e5a2dcefc78a5a4510bdad3bb7affcb7047b6acb502792e2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297798, "uuid": "2ee829df-1003-4c72-bf79-d5006ddd5535", "comment": "Malware payload", "value": "7d9d489fe2bd2b3cc4f93f5c7626f270a1ec71d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297798, "uuid": "5a226e8b-1b8d-4161-a127-96b30d434ff4", "comment": "Malware payload", "value": "f527ca8d2373f27a3c137f8ff878aa2cf0a5b7c3359bbf899c124db2827fb9ef9275e1b58d29c1d29866da6f1cebf51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297798, "uuid": "92928b25-09db-44b8-8908-b26102b35517", "value": "T144D47D58FF4E3C42E2C7E2789E4D83E1B32771D0D72391A23982425DD5CA9E9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297798, "uuid": "782f3245-5a7b-439c-b9b5-e80d346b5f30", "value": "12288:Ge9OMk4XmvkMQ/XMfTLrxpRfjpNr6eXbGAM64+slGJkQSw5kXFdFSh:B9OMZXmv/3rxpRfdNr5xMGtqnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297798, "uuid": "6df1b033-bbe2-4df5-8ca4-10630b76eeb0", "value": 638880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297798, "uuid": "a06abeb4-a713-407e-b2ca-e157927f53bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297798, "uuid": "56affd64-3571-4e67-b264-15cea5ec11f0", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99705eaa-e75a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767303675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303675, "uuid": "3dcba188-9e0d-4d73-8101-852e4e74c7ab", "comment": "Malware payload (Mirai)", "value": "b08821934f09db0851c077dee9d441c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303675, "uuid": "cd721660-ce05-4006-8ccf-802344c17c24", "comment": "Malware payload (Mirai)", "value": "8a2419d97fa687a4a7afc58528dd215a0dbd06651850fe8e00bac67373c3954d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303675, "uuid": "e0e1246e-4aea-4cb1-86a2-26516b340c17", "comment": "Malware payload (Mirai)", "value": "a640cee020be36904a3ec1ceb6dd5557c1052586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767303675, "uuid": "1798a6d3-df8a-4ac6-b61b-0679744927b1", "comment": "Malware payload (Mirai)", "value": "cf54f1ab4e41a1c6bd641b77ec0a209f7be402742d69b46cdd1ddd6414755ea748b37d499c01de146e69b1edf1e0fac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303675, "uuid": "61702bb3-abc6-44d3-bace-8b852afa9e0c", "value": "T1A4045B41F687C0F6CC57487050A7F73FCB32A82A4073D65EEF995F31CA27A4196262A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303675, "uuid": "75c775e5-ab38-4cf5-9427-506b75048fe6", "value": "3072:vmazbiHQLp0a4FdjBgMhYknXCJutPfaeqis0VRcsSf8J14hIB1l2o:xbiHQt0a4Lj2MhYknZ3aSs2I8JN2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767303675, "uuid": "fbf13a77-a2f1-4c9b-8dab-da581115505f", "value": 178884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767303675, "uuid": "109bc790-7e93-4404-b0cf-2b9c9913e1e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767303675, "uuid": "65860d20-42b0-44e0-a0cb-2cea8d9348e7", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ef4ba9-e749-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767296346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296346, "uuid": "68d4adb3-a3ae-45bb-946d-0d113a77e300", "comment": "Malware payload", "value": "eca2e1bbc9c7df3bfcff086c916b3551", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296346, "uuid": "4f45b73b-ab7e-4461-98e8-7234eba3b442", "comment": "Malware payload", "value": "8a4dfa48b6dffc5e99a662282de055cae64a9435257c608a764d255b7927c3fc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296346, "uuid": "0d62535a-3856-4d94-80a0-78bfaf4fd5ba", "comment": "Malware payload", "value": "05af96b6818e9ad7492684c780a04845dc208e2b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296346, "uuid": "7c8e4460-994d-44f2-9bf5-e060b969738d", "comment": "Malware payload", "value": "330bcc30077bcca2a4fb75b2913745cb11584c77b50a8435ac61b42d4dc1aeef9607594caf4878fbb65134654bd0f64f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296346, "uuid": "9392e99e-ddd9-4153-94e8-626d18a995e1", "value": "T17CB47B17BD80943AD9BA0E36893A87615B3CBE345A38855B6384750DDEF00D05BB3FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296346, "uuid": "bb82eb83-8928-4aef-a03a-f93a2a90322d", "value": "6144:gf/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkaaiN5p2rr+xR:gf+8jOZy2KsGU6a4Ks41x5VkzixR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767296346, "uuid": "ab4b6e3c-2195-4627-94fa-911f6a2a630c", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767296346, "uuid": "7d97a690-b918-4eb8-8eb7-ef40037d34ed", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296346, "uuid": "152360d2-7342-4067-8240-c02d5da590be", "value": "c95b51189e.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0010257-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767231665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231665, "uuid": "a3c63cd5-37ad-4607-8812-be028fae28de", "comment": "Malware payload (Mirai)", "value": "a8a59bb9e09d57b9c062db24981c6fac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231665, "uuid": "e7e3190c-b755-4709-a6a0-8e8d1a0cf694", "comment": "Malware payload (Mirai)", "value": "8aab426ea98338da5e06b55ed31fc11e00a3751e1756b1a1bcf70c047efb6dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231665, "uuid": "80b98ea0-5610-41a1-bc9a-a6e213888bac", "comment": "Malware payload (Mirai)", "value": "58b681dbe9d24e9012dd6dfeeddb6d080b06aba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231665, "uuid": "42681b60-758e-4ab2-a08f-11e146acb560", "comment": "Malware payload (Mirai)", "value": "8956e675eae0308df6584ba3710b3c49e0e289d8e6e4802346857d3f8199709f41ef669ed1fbcb67aee78d8e5e6bea2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231665, "uuid": "a8130ee3-14fb-4fc9-861c-bd92ecb8fd60", "value": "T11A73E986B8918A56C6D512BBFE2E118D33235778E3DF73139D105F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231665, "uuid": "da58849a-6880-4195-8d55-3f8b2c0697d7", "value": "1536:aRnxaf8a/aUoqweM+bAqKIvosmaHwe9aWejm7zQ9L38Mtiz4AAWhHu+7R:Jf7/geM+bpK0oVaHwe9Tejmh4AAWhHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231665, "uuid": "90a624f2-b5d5-4e54-9dfe-fffa8ea597f0", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231665, "uuid": "ee041bae-3d32-46ce-9eba-dc08692724a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231665, "uuid": "5a950ddb-e46b-4060-abc4-0c8af0d98e6c", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c49916a-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226639, "uuid": "6fb2b4b0-b938-4f43-88e3-46521366ae51", "comment": "Malware payload (Mirai)", "value": "abe27a632a549463bd397d200878590f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226639, "uuid": "dafb237e-6e15-49cf-93d0-fafaa5b9e933", "comment": "Malware payload (Mirai)", "value": "8b26449d57f1c070ed7e39c2098e53ade1836daf28abb84a2509c92b641cac72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226639, "uuid": "cb43b124-df27-404a-8281-c13952f84f42", "comment": "Malware payload (Mirai)", "value": "b1b7e45e52a3b5f207a63c1703ebeefa07e36b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226639, "uuid": "87583160-9415-4f65-83e0-779fd54d78b7", "comment": "Malware payload (Mirai)", "value": "e3e7e9bba9f3d659ee7221c9f0e7bcffeb0d4a079e1c597fdf46891116f32f9e5947d030fa2866c7364d5a469b058a5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226639, "uuid": "86b1b765-8a72-4b2b-8086-240ebcd5b544", "value": "T1E2634B22B97D2D1BC4C5A47B21F74365F1F15B0E22A8CA2E7D720E4DFF206602107AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226639, "uuid": "2294cab0-2589-43fb-931a-13cae7443201", "value": "1536:DScSMmxuY0NFohyx3ZePRgYqu4MvGqSwre+chD:eZMvNFhYt02e+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226639, "uuid": "575ad09b-0df8-451a-b74c-5894ab26319e", "value": 68672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226639, "uuid": "7c208f06-5ee3-4513-855c-7f5a69339faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226639, "uuid": "a6ad6cd3-466f-497d-b4eb-8d24da620a4c", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e69059a-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767226804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226804, "uuid": "672e3c8e-23f9-420d-9f2f-7679047c2246", "comment": "Malware payload (Gafgyt)", "value": "d0ea9aa8e6cd86b5d4ba055657674873", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226804, "uuid": "f473fd66-1508-40eb-9076-ecba949f6178", "comment": "Malware payload (Gafgyt)", "value": "8b4495c6d4458f14d6483d2022fc306dce62019d4d6d77ec30177f2c168bcc12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226804, "uuid": "385c52d2-7346-49cf-9974-e1eb0b62d08d", "comment": "Malware payload (Gafgyt)", "value": "ea330f79a038833642ca7fca021ec5306abfb4a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226804, "uuid": "dea1f3eb-00b8-4a96-8c9d-dc9013002f8d", "comment": "Malware payload (Gafgyt)", "value": "b9afa8b9def6bfe0f0109f709d2cc1a7a1c0f58682ee5064887f96f6cea4762927d4e4c81dcc0935f9e8728540bcb762", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226804, "uuid": "63e29dde-557a-4d21-9e78-88c4496d96be", "value": "T164115BCD2310921AC90CDF483F9D2B2C9759A794E5B48F249CD5093E9E9C609B06BF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226804, "uuid": "d9dfb579-e835-4696-b5df-129955982d72", "value": "24:pObgjIXnxNI5n01rKDlUpid+tfspiBCqituk2cxKyvYlTMuxv:pegonA0xylkiMtfMiIqiQk2uK68oup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226804, "uuid": "e99c86f7-b396-48e0-a0e9-3760bdc6e8d6", "value": 1030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226804, "uuid": "71fca400-9f29-4882-a116-c032bb817ef4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226804, "uuid": "3edae06e-e930-469e-bf49-2b218b8eca5f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b87f82-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226083, "uuid": "6f49abdf-ec1c-4fb7-bccf-a5e162e69cfc", "comment": "Malware payload (Mirai)", "value": "e3faabacdff62f3f875abf2aea9aafce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226083, "uuid": "17ea9334-c54c-4bff-a951-b47a149edcf4", "comment": "Malware payload (Mirai)", "value": "8bf6e94a236d485842059aff9b98f1317757a301da84418041bb52c0df80b004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226083, "uuid": "84afce0b-682f-4df7-96d4-153512a2de7d", "comment": "Malware payload (Mirai)", "value": "c26c1b634042d5327916e262639d5133e40cc0d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226083, "uuid": "de5491b1-c436-45df-9d8c-3ccfb7a2755c", "comment": "Malware payload (Mirai)", "value": "2050e4c6937b68af0717ae05f76febb8a0a2f84e488105dc2a3b7daa41f09bfbefa637d624e6779c758d8c09481e12b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226083, "uuid": "e5686d6f-e49a-47a5-b7ab-128c49f1a4d1", "value": "T1E063F64AFD819F15D5D525BAFF0E528D33535BA8E3FA72029E146F2527CA82B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226083, "uuid": "f3a603e5-ff89-4c70-86c9-5d6874d0f8de", "value": "1536:iBnOQvTq43bqQsJIu1HweY+6ydQXhK0Mm73sglF9lLoicLNt5HXBu+7RL:NQvW42QW7HweY+6y+xK0Mm73s4Kt53BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226083, "uuid": "5ac6f3c5-6626-487c-ac66-3565c6c097e4", "value": 67696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226083, "uuid": "3673ec55-6980-482b-acaa-24600d6d2838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226083, "uuid": "35e0b957-2cf6-4d55-ae22-2e5e2d539aee", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f229073-e6d2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767245193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767245193, "uuid": "2f610b61-0beb-415b-a3f9-76d53cd9a0c8", "comment": "Malware payload (AsyncRAT)", "value": "8be358f9b971b5450e1e01b5b8b37825", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767245193, "uuid": "d998a456-5224-4f03-8cf5-46f1d25baf27", "comment": "Malware payload (AsyncRAT)", "value": "8c6cd5dbb071f90dd61475561990b476ddbb00444a34de68d72582153cee5468", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767245193, "uuid": "f8da77d6-0d1c-4596-bc8f-e836298269bc", "comment": "Malware payload (AsyncRAT)", "value": "d62a34a9e784e1eeb307d5303c6e3753ad8668c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767245193, "uuid": "0db4a216-4353-4428-8af1-2f796ece512b", "comment": "Malware payload (AsyncRAT)", "value": "53012fd6998cc77982e04be16fdafb6dbad227bd2d45ccb1b1187f89e9e7e78a004797921888945517e62a625c91e2e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767245193, "uuid": "33eeddc2-7f08-4458-9ce9-332c523fbcd1", "value": "T140535B587BE9812AE1FFAFF059F22162C739F6275903965F20C502CA1B53A89CD406F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767245193, "uuid": "bbe768e9-826d-4177-979d-387df0c27f30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767245193, "uuid": "c98e52de-e418-49de-908d-4c9f69b3a9a6", "value": "1536:gOZLJF8gXO8Vpl5k/F4y+bf7uF8z9GAYcMROMoucvGU:LX5kh+bfTiOMofj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767245193, "uuid": "0e70cf88-9ad3-4657-873b-e1a326a3883b", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767245193, "uuid": "6c74679c-72b4-473c-ae94-ac4fa0cc5267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767245193, "uuid": "5be6fac0-0719-450e-9813-95dc64e964b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea30c325-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227360, "uuid": "36ccb516-8934-43a6-a264-ce5ee91efed3", "comment": "Malware payload (Mirai)", "value": "669116b257ffde54d0eeb2571200f97c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227360, "uuid": "a36993dd-910f-4b0d-a9f9-b2e19e164443", "comment": "Malware payload (Mirai)", "value": "8d3f14acec89de5a25196f45036b44d3ba6c8ea285b3ce5334d84962e00164c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227360, "uuid": "ba725d46-cd31-48d6-8b42-9d434f81d518", "comment": "Malware payload (Mirai)", "value": "25036f1c3e5cd68e1d27f38fd5a652381b7de2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227360, "uuid": "07dcce89-4b7a-4477-87ec-bff02f436c7e", "comment": "Malware payload (Mirai)", "value": "9318a77858c93ecd7ea0bb7403d5e3bc06ba283584b9b50f7bb1a814877036f35b106535d78028954945cc7c3532c450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227360, "uuid": "27d3a87d-9337-4750-92ed-219b19b886fd", "value": "T1CF257D59F1F370FCC567C03143ABDB627836F46911216E7B21C4EA352DA1DA02729FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227360, "uuid": "8cffc388-d286-4fa7-a5e7-f5da6cc2ee9f", "value": "12288:e8cE0/zoVN3Yo3qN+OXM6oucr7ymyz/6g5k:e8cE0/0VNV3qN+Ocxdr7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227360, "uuid": "79933e3a-c967-416d-b57d-52eb787eb0ad", "value": 967928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227360, "uuid": "546694e8-c000-4f41-ae9a-05945c1ca49e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227360, "uuid": "d8f187bb-7d3d-4df3-8518-7cdd31ab848b", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7264667-e73d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291296, "uuid": "90466340-28b4-4d08-9688-bfd3ffcf41ac", "comment": "Malware payload (Mirai)", "value": "43411a946d71944b65c1682cf5a52308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291296, "uuid": "534b7ab6-38e6-4704-ac52-258e60d3bc43", "comment": "Malware payload (Mirai)", "value": "8d4114085617b84cccd9aabfd521f669d11e8e4f8dc1f966f5ec12ba1d07cf6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291296, "uuid": "cc04842e-e59f-4a2a-ab7c-ca5111adff8f", "comment": "Malware payload (Mirai)", "value": "448113d7e5dd4ab156699e00286da392f03b9226", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291296, "uuid": "0bc29429-c28e-4d59-8e51-c20fc9d9f350", "comment": "Malware payload (Mirai)", "value": "cacac44606db3c1c1d08e8115dce1f5e12fcc6cc452145995cb9bc8bb96652cbd2ead5739dadc11b50ee4fe3a483181f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291296, "uuid": "1e2bc250-d3ce-4f4f-9786-c68197e05f39", "value": "T19AC3F185BB6369D1C1A242BDA4C00AC387916E318BE317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291296, "uuid": "7662f738-643c-46bb-b51f-be8ef7e64f23", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnv:0OCDjXG9qTWywxlxTnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291296, "uuid": "f9c51532-0500-45b0-9788-2212a76b0faa", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291296, "uuid": "cebb83e9-83ac-420b-97c2-bbdedcf9efff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291296, "uuid": "a5777fd2-e140-4842-b948-9f0a36c50471", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21d1926-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226434, "uuid": "961a6fe1-3b23-48c4-972e-4b927d43af53", "comment": "Malware payload (Mirai)", "value": "dfa223884cbda2f3761b229c3e011287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226434, "uuid": "ac69c4b7-0164-4be0-9e2d-0ecdc5856146", "comment": "Malware payload (Mirai)", "value": "8d9d8a82b13e6bba00c7bd1c461ee2f87f93d2d85ea67a27f1a3209b1af50f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226434, "uuid": "1c8d7592-8411-4f62-a4d8-5dc965331180", "comment": "Malware payload (Mirai)", "value": "89f4c74d0c262a7ac0d397dc19990f30acee5d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226434, "uuid": "34d7cc41-7222-4230-b2ab-0265ef306efd", "comment": "Malware payload (Mirai)", "value": "0240a53c915dc969743eabbf8b59239c0273ea3b50c541fc77d4338af6cf8c3f55538324aba338ad07c4b50509f0b117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226434, "uuid": "47fee999-b6a3-4bd3-8131-55a4361dcd7d", "value": "T16FC34953F000CD6FF84BD7364283CB31B63273A6ABB317627652A53B65383A51D1AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226434, "uuid": "182c7a0b-daec-4bf7-999f-e62c14b01292", "value": "3072:B23eVw2wkE1YdVJO2PEsbwOykDR9546swulflSsm:Bla2c16blHDr5HSla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226434, "uuid": "4624178d-cca5-47db-96cc-da97723fa3ea", "value": 124660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226434, "uuid": "7a250ffb-fd9a-44a8-a2b3-50a6638718c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226434, "uuid": "a746cd06-d4e7-4dc5-8cf9-ddd20e1f506e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dc90be-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229051, "uuid": "4de417be-3e5d-4ba9-9962-8da32a9f8742", "comment": "Malware payload (Mirai)", "value": "af9d378a936b4b33606763cca9b2e59d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229051, "uuid": "b5ce32cd-7a79-4852-8842-448e94fc8be6", "comment": "Malware payload (Mirai)", "value": "8dc3b44321a22f6851b1c43ca49a4de455169aad6cc1ee694fae092ce2e0394d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229051, "uuid": "515f2489-67c5-4bb3-a50c-a2fa93dc9990", "comment": "Malware payload (Mirai)", "value": "f20a570fc4c6ed8d39a8781d74170a2398691897", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229051, "uuid": "18866e0e-ca89-45ad-9fb0-5154ceaecfbd", "comment": "Malware payload (Mirai)", "value": "b63b3ca6c0697ca85c3d8d2ad808e3ab7b7456cba5ce44b259682aaf4f4fe601c2c1c352f5d3e9536ff4577b0288e1cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229051, "uuid": "387cc7ea-9b01-45c5-abd1-9c9d7cf11bb6", "value": "T1B401C0CF10445E3175C845D93AD3542E585046E316E4461DAEDE857358C56187B9CE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229051, "uuid": "0631ecde-7827-4985-a19d-22f22552ab73", "value": "24:/9ZOek933v6hLk933v6nRk933v6M5dM5nk933v6rOOk933v6rFk933vXw:FZTk92k9Wk9vI9k9ok9+k9Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229051, "uuid": "33f58b5b-8d06-488e-9a6d-d3d72aa90165", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229051, "uuid": "fd05c1ef-182e-4b0f-8e4d-3802d27c1c4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229051, "uuid": "06957e9b-b7ca-4a6e-9336-fe4f612fbb68", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7616c26e-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225877, "uuid": "dd55e2ca-b30e-4d9e-a865-a33d9f0e0032", "comment": "Malware payload (Mirai)", "value": "8fbfc9a87342e6559369788d88d60823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225877, "uuid": "a2615f3d-0e5c-4ed8-9ffe-eaeef490b0ac", "comment": "Malware payload (Mirai)", "value": "8e05ba6e2bef083acdf06f4f2b581c32e0850bd78c32fac6cfa487f4586a8c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225877, "uuid": "c8684f4e-ef27-41db-80aa-169fff4fe1e1", "comment": "Malware payload (Mirai)", "value": "986660edd45dfc3be73dbc423e06120855cd744b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225877, "uuid": "6fb506ee-0c00-40da-a9e7-70663e3781db", "comment": "Malware payload (Mirai)", "value": "2f55b0d848ecdb049e6e7a295f2ddaaadb691cd1f7aa1aadadacff3676da68a2181c3285f24e68df013369ed598a751d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225877, "uuid": "6415e45c-6e3d-43e3-9c93-192d141ae757", "value": "T1348302ACC4D4F4E2CCAE4834610940B222615202FBADFFF973B354B9695890B7C565AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225877, "uuid": "0685eec5-c286-4594-91da-5759cc463e2a", "value": "1536:E1EIJW2CTnYqzWNRqurI2fjLloK2p+90oXZuYqkoKietR2K8wAOZv/:hkX6zWOus2LLa+0osY1oKieH8wAav/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225877, "uuid": "6dd4ab24-7572-4857-81b6-b708f31cbc54", "value": 81496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225877, "uuid": "0a55f8d3-9b92-4ca7-a72a-fe127cc85ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225877, "uuid": "06ff322d-2e5c-4e89-8195-3890a9cec4c6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9e9431-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226260, "uuid": "7124022b-c344-41d7-9ae2-50ba6e02f88b", "comment": "Malware payload (Mirai)", "value": "4fde0d16a6f39871becea7508e157d6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226260, "uuid": "7c92d874-fe14-4476-835d-bc13616a4f67", "comment": "Malware payload (Mirai)", "value": "8ea7f85b5f71857f95146ec152cdc2e1b90747938d656499e8e3886793e91eb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226260, "uuid": "ce20bd51-70fb-4611-b4c3-1037340e0a71", "comment": "Malware payload (Mirai)", "value": "7a3f59c9958daea3339ee25c771a4714b7063bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226260, "uuid": "c53e8700-f020-4c3b-8d7b-09545283b623", "comment": "Malware payload (Mirai)", "value": "2b194d51da783a6c281944c56ccecbd2981d5574969b3c0781ffeecdcdd1f41d560db4780ad901f17c95ac4d3333d384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226260, "uuid": "4cb7593f-ab15-449f-a9a4-d95939959eeb", "value": "T1F3A36BC3DA53E8B1F4625075162AA7638A37E1362431DD4BE7B82F71ECA1B50DB113AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226260, "uuid": "06e617b8-5cff-4716-a1f5-5b98f2b67625", "value": "1536:rQSQs6YNBAVSATVa1xogS9CvbOn2/xfEYCB44gWRufx3VBJznZSUc+H/SmrAE:ss7AWbpxBWUfx3Jzn0n2UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226260, "uuid": "aa2a65ba-b5a4-4224-a8b7-acada6047fd0", "value": 103920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226260, "uuid": "d78600b4-57c3-47b4-a9ca-0f085d27e3fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226260, "uuid": "6dc4af27-3681-423d-a19f-0259644682ba", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea24657-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228495, "uuid": "a7481bd9-8632-43ee-b7a2-e7b7b8a9e1b7", "comment": "Malware payload (Mirai)", "value": "550a65f884a5ebb98e1d431793cf9cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228495, "uuid": "a62a111a-c7e3-49e3-929d-2bb7a88ef9f4", "comment": "Malware payload (Mirai)", "value": "8f44f026e43ac0687948f34f3d39cf9de3c1320ae3dcc8d49d42106f4684c280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228495, "uuid": "9b999ebb-fae8-4d03-a14d-a2af63a3d9c6", "comment": "Malware payload (Mirai)", "value": "4413b9120d92487159e01679b0b918c850683394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228495, "uuid": "7da5de97-f96f-4587-bb8a-d5d1e87383ec", "comment": "Malware payload (Mirai)", "value": "c0dbac0cc46bc046225545b7d686499ff92ce395643277e91cc71f7bbfcbed3770737e7c488d31915dc3a8f72e603b84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228495, "uuid": "79baf807-34b6-4b8f-a6d1-ede6356da854", "value": "T177231944BC819A23C5E4237EFA5E019D372563B8E2EF7217DD215F15778A82B0DBB602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228495, "uuid": "a23b5cc9-d44f-45f3-ae6a-27b9338ed5c4", "value": "768:U9D9cBys2kt66oyPnMw57hMJWQ2vWlScqN+WAnnXyu:U9SyShnMQ7OJL2uccU3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228495, "uuid": "72a479f5-d60b-4287-b885-b3a5bac7b425", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228495, "uuid": "5693d658-26ac-4735-bc41-2ba1f544f67f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228495, "uuid": "1bb93d3f-4d48-46c1-b8b1-0daef21486a5", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d024bb4-e6e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254235, "uuid": "74287821-4b3c-4dad-a9f5-fa54bf363b6a", "comment": "Malware payload (Mirai)", "value": "285428ad78ad81335ae73e3ded243340", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254235, "uuid": "222521f6-1f3e-4cc2-a6be-d73be3e7d146", "comment": "Malware payload (Mirai)", "value": "8fd4af07431ad9132f52cc11f2bedcaa13059fe45c50d0262399f17a5fb28954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254235, "uuid": "49d096d1-9c8c-482b-b60c-81c7e09b4069", "comment": "Malware payload (Mirai)", "value": "2a13d4b6831c64038483dfcdfbb800f945e7d0c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254235, "uuid": "2aeaa057-9c19-4dc5-8000-8100eb56909b", "comment": "Malware payload (Mirai)", "value": "051cbaf830ff30e375a2262e27aa90df3fc7908c239f2cf8ea83438a2b8fbb6cf94ef30c2e20fcb0772af2f1e9c52129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254235, "uuid": "4c45300c-0318-4cd1-962c-dc1fd9389c0e", "value": "T1F4536AC1A683D8F9F91A02715177E7364633F47A016DDA93CBA89932FC12900F75B2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254235, "uuid": "0ace338e-8125-4e0e-a8ba-b55d83330b08", "value": "1536:jsu+iQV3XHNP7WAkOq2d9llRCu8s26kdtsXOSQA4tmbIw:js5xVXHNPQo9t8H6cs+Sx4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254235, "uuid": "69977f8d-f41f-43f5-b57a-1ba69c3c176f", "value": 62768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254235, "uuid": "349148c0-4f22-4fb3-8fab-837466514e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254235, "uuid": "fb897806-ccc0-45a3-9cdc-9decc0479528", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ae1ccb-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226811, "uuid": "38629fbe-2a96-41a4-a923-7794f43b019a", "comment": "Malware payload (Mirai)", "value": "b9e01c7e8f90d7428ff7b82238ba85e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226811, "uuid": "98fa816b-37ee-482a-959f-de6b8f3469a7", "comment": "Malware payload (Mirai)", "value": "900f8b730bd8b15e8396604c81e442729a93a9d3bf2ebe3c0951cd9606441b00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226811, "uuid": "ce4e0f91-3209-49fb-ad65-4e31270de979", "comment": "Malware payload (Mirai)", "value": "86b634072aaf8ae850a7864918e58594ebcdfb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226811, "uuid": "1c12593c-bcda-4917-bb8c-95ef1f263136", "comment": "Malware payload (Mirai)", "value": "abf05c0e601d9948039ec990aff731f716015383602b0c3fc4550e774682918a48d24a54794244c10151547ebf73f4f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226811, "uuid": "fef4fd12-e5cc-4239-9afc-b44b25e2fb4d", "value": "T10EC31995B942EA22C7C256BBFE4F428D37169398E3DE3203DD145F6433CB95B0E2A245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226811, "uuid": "9a8d495c-37a8-47f8-b89f-7dcfcdf1b58b", "value": "3072:L2clPovBHfIxJG3wYDEnNVrJBbM+7Un4v8m0y9nT4:L2uPIAxU3wYDANVlBbM+7K4Um0yt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226811, "uuid": "27aa1584-fd83-4d55-b320-1afeda336527", "value": 121160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226811, "uuid": "3c73203b-f716-4d30-a890-9351ee16eef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226811, "uuid": "27e5da4d-7581-4ad3-ac49-c89c52fb913c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d10b9d0-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226989, "uuid": "9eae304a-f25c-4a07-824e-3ac034b9016e", "comment": "Malware payload (Mirai)", "value": "7bd76e9f0c25a801d725f8b50f7b2cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226989, "uuid": "40519554-378c-491a-8232-bcd6a820137e", "comment": "Malware payload (Mirai)", "value": "90539206015f0ca688bdbd0ce6af67e1c5dc26151e85e592f6b2940fe82ed99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226989, "uuid": "96ab253a-794b-40e9-8aee-73c6836a5a39", "comment": "Malware payload (Mirai)", "value": "97fec7d360e5a0281df5c10e9b7082302ea6dfa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226989, "uuid": "dd94ca6e-0bfe-48b7-bc91-085a3e0ab8a2", "comment": "Malware payload (Mirai)", "value": "c0843010b1ca2f2c166d1f9df6156e531a7cd4d11244247aabda1bf4009913f18370618f37b8a84a06482d4d62bae306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226989, "uuid": "3437fc08-ad08-455e-b1ad-529cf9607bd2", "value": "T19783084AF9819F15D5D922BFFA1E028D335367A8E3EF72028D105B14778A92B0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226989, "uuid": "0e7f7c60-540e-4faa-8e00-53267a9286ec", "value": "1536:aRnZLuyteh2l1FWc5Xsw9HweyvKlrGowIDRrysZ+MbjNl94i43T7RlruM7R:ABtLPFXr9HweyyJGowIDRrysZ+2u3Trn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226989, "uuid": "3ef6b239-98c3-4ab8-a068-c5b809eff844", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226989, "uuid": "154a6db3-26db-46d1-b2ba-343c649550b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226989, "uuid": "9d85ee58-8a81-4a0e-9c68-b7a608eab455", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7564895c-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292018, "uuid": "5e40ff55-4cf8-4c5d-bfe4-74f5bd35f239", "comment": "Malware payload (Mirai)", "value": "bddf45e5663b63ca49cce25111ee2542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292018, "uuid": "a34a8a76-9226-4db3-a5e6-22637fa69a12", "comment": "Malware payload (Mirai)", "value": "905df6911c97f3622a111ea55c5cd2e433904ec480e4bfa0e1b73d77f3613597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292018, "uuid": "e77f2d4d-634d-46a0-984c-608f93c9157b", "comment": "Malware payload (Mirai)", "value": "30807453c5cc2e4e1e5197e47846e89c5f0c59d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292018, "uuid": "9df7af56-5b81-4d9c-88b8-fce3cf41fcaf", "comment": "Malware payload (Mirai)", "value": "7f20d9e58b3d016a5a8222ce39e7ce8eff790fa7ff4d86ed6485530c6dff5305aca56246087a24773cb651eecc33f8d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292018, "uuid": "3b95c89f-6786-4542-9576-c1a536435cb7", "value": "T14A7319D6F400DDBEF80EE73B84570506B230E3A60E921B76231B756BBC750A5593BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292018, "uuid": "7c1c0b08-30fa-4f93-b007-a891920dab36", "value": "1536:RZhvZWluC5KAsp0mxJnEfk8Kr8z6yMkTyfo6nLiQ/YlQMQ/2WHBnc:RDh4IB5nEfk8KnyMkTTUi8YCz9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292018, "uuid": "b341ca3a-d262-47ea-a371-8f16dfea5309", "value": 74416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292018, "uuid": "04b746f2-c1f3-46b1-8df5-2438e6ad3a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292018, "uuid": "977b7385-1164-49f6-864c-9c9d1dc6c02d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ba708d-e71e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767277761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277761, "uuid": "c9272bc5-ba27-4a1f-a580-0c11b1839923", "comment": "Malware payload (Vidar)", "value": "efed6a98df13b9050f4f6b1e96603c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277761, "uuid": "be30422d-799b-4efe-8234-201dadabcb4a", "comment": "Malware payload (Vidar)", "value": "92ece9b666dc561c95bc30142d3d5d0c73492b5a6793475659c432387fd75421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277761, "uuid": "15c1e24a-b79f-441e-9fe2-7e8e983e6e54", "comment": "Malware payload (Vidar)", "value": "905537c61841ba7936045b26d2a1c24531de463e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277761, "uuid": "8366fece-b241-4d87-b31b-84b5c4ba768e", "comment": "Malware payload (Vidar)", "value": "149f4eb61c690db1e1669f8f6415adc435145db46d9c8888407ea40346de377432f499bc0c2316702d488585f25ea3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277761, "uuid": "817c0fbd-e5bf-47a1-b577-75a5a696eb8a", "value": "T1BE9618A3EE50422DCADBD23AED7662457230B184133512C77F670BA54DCABC45B3B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277761, "uuid": "9dfb220f-405f-4a8e-8232-35befbd76452", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277761, "uuid": "e1d81811-4908-4e30-917f-fff2a5036613", "value": "49152:7wB//Qrb/TUvO90dL3BmAFd4A64nsfJLONNh2WTow5acFca7quI1qeYu9jn2K1MV:UB6tGIDZdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277761, "uuid": "b2757a0a-042c-4804-9b30-7301e62748a8", "value": 8777344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277761, "uuid": "d5013194-7f04-4757-9806-e0123277b230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277761, "uuid": "75e3a476-e850-4769-a4b9-1a295a6723f6", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea04a883-e706-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767267733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267733, "uuid": "5b781be4-5741-4e02-9855-e5f64ca581c3", "comment": "Malware payload (AsyncRAT)", "value": "a5e0bbc6e0b2b63c9809f20e29a0c287", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malawre", "colour": "#AF6E9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267733, "uuid": "f184b19a-7a49-433a-b2ac-b858c1dc47d6", "comment": "Malware payload (AsyncRAT)", "value": "948da7e7445902416f717fcaebd98d1bbae5601898204b9e3ac26d9853562b01", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malawre", "colour": "#AF6E9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267733, "uuid": "facfff34-30cb-4192-bd51-1d207c15cd69", "comment": "Malware payload (AsyncRAT)", "value": "c9dd5e731992a173f71d0bce81b04fee043b5b7b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malawre", "colour": "#AF6E9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767267733, "uuid": "2a8af229-2b79-4ade-86b5-ece74531436c", "comment": "Malware payload (AsyncRAT)", "value": "02efa5512e30265c95f381427fbaf16c624e7f3284396b376514195c32bcfd56bb5e48f8ac4f8d8e5ec4078057aefa82", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malawre", "colour": "#AF6E9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267733, "uuid": "476fbfbb-0e3f-4645-9de1-d1742bc2bf33", "value": "T117C21B0473F48262D1EC4BBE48329600D375E68B5D53DB9F6EC499AD2A337CD8620BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267733, "uuid": "47fc1086-3f17-45c7-a782-c2dbdf10d80c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267733, "uuid": "7c0b8094-cdb6-4640-b629-b94a0760964e", "value": "384:vQ4K4Rt1zgeLsQk5MMymrJhxUHqqbuUsJQxnCJf+BWfXWfjL/iu+:vQlst1ERQk+MyCJhxaFbHBFBmu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767267733, "uuid": "9d204e8e-14a4-4e80-bb20-8d3fd1819952", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767267733, "uuid": "00f980c9-8178-4ea0-8245-bd082821c386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767267733, "uuid": "f23ff1ab-464a-4a26-83c9-a0c49211ab2c", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004128e0-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767231263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231263, "uuid": "e5b20524-8cbc-4ab7-aa1a-daef13db5789", "comment": "Malware payload (Mirai)", "value": "f3e5948876c94c938fce106fc6c827df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231263, "uuid": "98fdf91f-3d87-47ae-87a3-99bcd2e13e16", "comment": "Malware payload (Mirai)", "value": "94ababe6b8fb57cf11f2556513490ab6ad96827f742c8e04df2d4904b3474449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231263, "uuid": "93a06c0b-afd1-4c7d-b4ce-3da3c3e91665", "comment": "Malware payload (Mirai)", "value": "f37e65f06a037189874dede99b98246638da6ae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231263, "uuid": "606a9ad3-5326-4bc7-b8c0-96f882762e87", "comment": "Malware payload (Mirai)", "value": "4386881fb1444d79ba3405ce42195cbddedcad00eebe35940d99f0f733e29dd6cab20525f2c3c0440a60a3f4ab3673a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231263, "uuid": "80004eb1-92e1-4747-9cd4-0ae8bd7e178e", "value": "T113245BC7F801DCBDF80BE67744230909B530B76250935B377257BD67AD3A0A94A27E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231263, "uuid": "93db4c47-96ca-44c8-8191-3de2ac6c1fc0", "value": "3072:+o7oEj82+GCB7bNo6vx6U2b/yLGPPcXPzt8+xGJzrYmVxjbipLGg6Inuh/FLmw5f:U2+zPJEzyLoPcX7tYhrYRLGFW0mWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231263, "uuid": "656f9e7f-2b62-445c-8638-46c4279aacc3", "value": 219724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231263, "uuid": "e2f82b8e-a749-4ae5-a8c6-61d902aabdad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231263, "uuid": "b5ce1638-22b6-46ea-bc18-db85e26741c6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a88b09-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292559, "uuid": "630af2a3-ad31-46b2-85a5-35800dee1466", "comment": "Malware payload (Mirai)", "value": "1fb4dea2ac2da407d66fe4b813232ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292559, "uuid": "02822aea-520c-49e9-aaea-cfc268e508dd", "comment": "Malware payload (Mirai)", "value": "952143d7c9e74a40ed0266b5698fea90fee29fcb5bf8faa985c7761111d4800e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292559, "uuid": "16d59116-5501-479d-9191-81a2496d90a0", "comment": "Malware payload (Mirai)", "value": "02e72ec0f54b5e41b268f59d1e4aefdba62b3e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292559, "uuid": "cfe662d4-c854-4319-8fb3-bd6ea3c49f9a", "comment": "Malware payload (Mirai)", "value": "d5cb87dab526f1d7670aafac8991b8534c5f6f44264c102b3a8acf48305433de5515c6b470928a5aeeca6669bb1626e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292559, "uuid": "b2a3ab1d-2918-4e8b-8cb5-c4afd52f742d", "value": "T161B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292559, "uuid": "991c2525-1f89-4d9b-85d5-fd239e9a2c92", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzY8rSR:t3SrlGWnKTU83AQB5A5Liy36fUUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292559, "uuid": "25514954-a6ab-4fa9-8c5c-6732b85dedc6", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292559, "uuid": "a76c0124-dcc9-4000-9cd2-f52928ac54bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292559, "uuid": "2fcc3c04-cf94-4da0-8afd-a49621197b9f", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef698477-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226080, "uuid": "564adff3-77d8-45d7-bb9c-45cf4d5634e8", "comment": "Malware payload (Mirai)", "value": "cb0882120128d6fd26c52f0d54080cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226080, "uuid": "579250a6-079c-41f9-9041-370e6ed72249", "comment": "Malware payload (Mirai)", "value": "9553152b82de68774432016553a3073ca176666d02206e1469c419e64b6bc08c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226080, "uuid": "e0755b20-450e-4d35-9633-ab57bdcc36d6", "comment": "Malware payload (Mirai)", "value": "4b40632a64f40af28d3bce49787628bec6d90908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226080, "uuid": "9c24bfcd-bc63-4039-9816-b09dccfe01a3", "comment": "Malware payload (Mirai)", "value": "aa47ade5fad4154f8d2ae077647e79aa766ab2e06646cee5a72501382d1f6bf926b553f60420b3e262633b3fb1a74812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226080, "uuid": "8df35804-baa9-4e8a-86e9-55bf17b1784f", "value": "T186B38C73C8392E58C124D6B4F070DB7C8B57940195871FAAA17AD3BA8487ECCF94A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226080, "uuid": "a3eb531c-2bdc-4667-8129-526331877025", "value": "3072:xbgpzgATfSPRmWG48D3hqhOL/UzTZLk2E4cnTi:xkJTf97hGO/eFC4ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226080, "uuid": "383421cd-e529-4254-bf5a-63adb3df74ff", "value": 107952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226080, "uuid": "59110220-62d7-4613-ab88-09b842d75778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226080, "uuid": "93b060ea-8572-4696-ab6e-1e0722782d5d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443d99b3-e6fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767263589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263589, "uuid": "0f702a96-1616-44fe-8488-fd36e87477cc", "comment": "Malware payload", "value": "db4d4afb131287f554189f436ec988dc", "object_relation": "md5", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263589, "uuid": "b7eae1dd-26dc-4255-8b56-3de6be354bb9", "comment": "Malware payload", "value": "9589717a8a2f522029a1a70a7a083545c2c24cef0ed60571955d8d442e475eef", "object_relation": "sha256", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263589, "uuid": "2b1f8ef9-64ae-4bcb-babd-ce246284eda5", "comment": "Malware payload", "value": "f177535b2ad90cf5c6b1a4e5dbb248b017bd4f6a", "object_relation": "sha1", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767263589, "uuid": "47a22d52-f9f0-4016-802a-98908cf91bfd", "comment": "Malware payload", "value": "39d1699d4125f2521ed2598a3d19fd564354b769dbe99104a48133596d144f145516ac336991c4c49dc051735a0d77e2", "object_relation": "sha3-384", "Tag": [ { "name": "185-115-34-131", "colour": "#3022DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263589, "uuid": "11e0ec1a-b7a9-401f-a20c-e2a41daf35c5", "value": "T1ACD33C2D5E8AB8EBD4240EB55C66E7D1067CEFA5F0E1569834E8BE3CB792474C500FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263589, "uuid": "eeb4b595-60d1-4dc5-af32-af40a659b280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263589, "uuid": "8d01fc52-5565-4a7f-8c41-5a58e6342aca", "value": "1536:BijbK8+VRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3I:ojbORUGKXs+S++7KFSbxeY+qDDrMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767263589, "uuid": "f7164669-1005-4ea6-ad2d-209d886378f8", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767263589, "uuid": "59149bd0-7b22-4694-b794-a47b91ba9e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767263589, "uuid": "e6097b25-57f9-4af7-a776-90b22fa90f7d", "value": "MicrosoftEdgePro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3234f69-e6fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767262997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262997, "uuid": "13d98501-d2e9-4647-b05c-c426c953d9eb", "comment": "Malware payload", "value": "49c61b89b52789df17dc28cb4809ed32", "object_relation": "md5", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "autoit-config", "colour": "#B5E91A", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262997, "uuid": "413812a9-3c84-4808-8e26-1f231c6d09e9", "comment": "Malware payload", "value": "963079d4b7b22f2c3c0e9f0741ae910d00eef164a9c4a97c45e6daf9c2f81aa6", "object_relation": "sha256", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "autoit-config", "colour": "#B5E91A", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262997, "uuid": "6941db7c-1d74-43b8-9e14-db87566f5ed4", "comment": "Malware payload", "value": "469445c1c0efaa0eaa37a319e08943cbdc4ce126", "object_relation": "sha1", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "autoit-config", "colour": "#B5E91A", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262997, "uuid": "d281e4fd-86ba-4a65-8b39-aef56e268ed8", "comment": "Malware payload", "value": "5baf0226dab0a40bdaba588601b37ba0c288d662b7e924fc6c27c5d1ccccefb79f96722d75645607054e90bc4d4cef8c", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "autoit-config", "colour": "#B5E91A", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262997, "uuid": "22c4d750-c0a1-4a71-b02e-76b9ff92a04b", "value": "T1ACC3124CBB8199C9B4C179E1937173E776966C38089879CFBC6C8176BE6C20B874F251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262997, "uuid": "4e6464bd-2079-4015-b3e1-499847534c0a", "value": "3072:LPPzAo6oRVnPqIcxqChjVuQvMmii0341Tg2L+3n97Xct9zNkGAQ:DsXofIaR3GTg2L69o3xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767262997, "uuid": "e18948cd-a760-4944-bb50-e21bbbd000e3", "value": 129917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767262997, "uuid": "77443e24-540d-4213-8272-485a21149989", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262997, "uuid": "d1fe6511-cf5d-4a73-b24e-7108e10d57eb", "value": "HUbMGL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d12ae48-e744-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293991, "uuid": "b2daf07a-62f4-4a6e-a630-506dda0e8a64", "comment": "Malware payload (Mirai)", "value": "7591b41c4603ac730821e70b3fb100cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293991, "uuid": "adb4aa86-d36d-41fb-9d9a-1bd6b1e4e0da", "comment": "Malware payload (Mirai)", "value": "9a51628d92aba4d46194808f2892e0b81cb4a577f4d0bbb50c43a498631732b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293991, "uuid": "ce22b7a6-7841-4c8f-b436-3d5b076194ab", "comment": "Malware payload (Mirai)", "value": "ef7074de114ec72e820e44aa7cc32bf4ad2a9bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293991, "uuid": "36accff9-00bf-4f7e-9221-02aa075dfe1c", "comment": "Malware payload (Mirai)", "value": "1f23b89827bb0743281b08ddaf272345901d6836fcc98694f0cffa765b06c8bb7e6838c3c4deea49fcff550af7b77f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293991, "uuid": "d1943d5e-84bc-4ff8-a091-5b284b117d2b", "value": "T1D504392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293991, "uuid": "f00735f5-6f50-4a8a-b39a-1bd20bab82c5", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w6UXS:7eJpJUVD1A8n0YNgEJi5aHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293991, "uuid": "39d0896c-94b9-4bc9-b3ee-68adeeafefbe", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293991, "uuid": "5e6107d9-da3e-4c7c-96cf-3af28171b883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293991, "uuid": "4620f91a-e730-46bb-964f-c5efc78f8c20", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5285bb65-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270485, "uuid": "af77d3b6-9cb0-4cfa-9484-e691088cd708", "comment": "Malware payload (Mirai)", "value": "a4ffd09d4e21f5ede07608d731887b1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270485, "uuid": "a302fa03-2506-433e-9480-85d6b35d8140", "comment": "Malware payload (Mirai)", "value": "9b104535e94ff239240a30e252ae95d3f17d80fb8d5f084f5513a2a35ff82d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270485, "uuid": "fa3b53a8-950d-4e51-a7f8-6b9d73eb8708", "comment": "Malware payload (Mirai)", "value": "272e0d5d3f2d60cfc605757d0cc91925ef2c5413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270485, "uuid": "8e3bd22b-d358-472d-8140-8d64a0800d5d", "comment": "Malware payload (Mirai)", "value": "6b1fca7432dc0cece3ad9997b61cb82f7a539b858b029c4aaf67a62d610f4eda1f0b99c0c68225c138b14bc8ffaf202d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270485, "uuid": "b4a1dc62-4f38-4739-b22f-29c91fb46c4c", "value": "T19B338E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270485, "uuid": "c3688aa6-f9bd-4ae8-a788-7b7271b6dc5e", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCx6:EcdC753UlwtNEFyGoMD3X3qlGXCx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270485, "uuid": "742644e3-c2ad-4744-8c9a-c1998d7a2531", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270485, "uuid": "a41b15cd-e149-4b14-ac97-1e2ffb0e890a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270485, "uuid": "14ac24bd-ec89-43ba-a9b8-4ffaaf11b113", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e41db70-e739-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767289483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289483, "uuid": "79e8d4d1-bcdd-4cfc-8b9c-b423658d9d61", "comment": "Malware payload", "value": "db3ec2865d2e364148743b8778e572ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289483, "uuid": "2f22357c-7d63-4a71-ad81-04955237662e", "comment": "Malware payload", "value": "9b4198dda283bd3c8fa1ba14a93a140b10a35adf5875d805c9926199e4ef2e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289483, "uuid": "ecbed836-a125-49e1-95c4-531f1f16e0f8", "comment": "Malware payload", "value": "da87a1d09cde4abdf7fc146ba603d2333ebcd248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289483, "uuid": "96c70edb-811b-4f71-a266-d8ea7801fe4c", "comment": "Malware payload", "value": "6d8a30a9d4d10631e2d38c72fba4589f932ea458eddc1b28df5580bd5242d754689ffbaa66aaa401d99117c48d7a6e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289483, "uuid": "61abd26d-ce56-4ada-bd78-abf8c2f3e156", "value": "T1EDC588F0AD01D8C1F57E5B7AF3ED7908A1343227EADD5A4A00A466591EF6A01FD0ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289483, "uuid": "c9a6ca54-99fd-4e4f-a3fc-47e280d0e5c4", "value": "d217325e18ecf5ea699569d6558c6b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289483, "uuid": "66cd543c-7096-465c-8535-ad73e3051589", "value": "24576:1esPxyMRxoaKg38eJNq+zGNYaBQxSy5a6ZrsWElqqcpud:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767289483, "uuid": "80dc6f60-1fe4-4589-ad2d-eae48815d9ad", "value": 2651648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767289483, "uuid": "74d74151-f5a4-443f-bf44-1557a2fb9737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289483, "uuid": "01635253-291b-468f-9e46-6cc5a9587d44", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c13e63-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227358, "uuid": "5eeac4d4-b21d-419f-a8ee-ee8e93620645", "comment": "Malware payload (Mirai)", "value": "3b4d6341c9add554f13000e1ab401069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227358, "uuid": "7e70099e-cb99-4b93-b6a7-83efa924d5bc", "comment": "Malware payload (Mirai)", "value": "9b8119a5693fe09d5f962b3e034d66d50e53584f63b5192af62a2d2c8681997d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227358, "uuid": "9a4c3102-9aff-4fb1-b5e0-6796d3c2385c", "comment": "Malware payload (Mirai)", "value": "e889503526556537c22da582330a3b55640b22c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227358, "uuid": "dae81396-692a-4128-adf3-a7d3241e5754", "comment": "Malware payload (Mirai)", "value": "7f4517e274be5ece26af83fe7b450875391267d7bc563db271c0f2de5d2d1cba71526fe4f105bc1b6f9099f8b153e1ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227358, "uuid": "9c7601fd-1607-4f71-952e-c3eeb193e1e4", "value": "T1B3B37DC8A243C0F2D45701F1613BE7776A32D5B96119EE86E378ED31A8D3842E626B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227358, "uuid": "2f5c2b3e-95c0-4323-9bc7-19d64a1a5fa6", "value": "1536:x6+jOEvzgu7MmBlHT8QpHprXcf5dx0ldzSaIctTsukaWHNSrMJMIj7mcY:xQEbPMmBdjpHprsf5P4dzVIctIuYkfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227358, "uuid": "3cd72211-d4b7-42af-b389-2d0c0b5803bc", "value": 108936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227358, "uuid": "933c69d7-dbfd-4131-836b-56643464de29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227358, "uuid": "eab4e232-577c-49fa-90d7-168f378cf275", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5137a0-e6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767258556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258556, "uuid": "809e6109-ba29-41b8-9f71-fdfd60912197", "comment": "Malware payload (Mirai)", "value": "20b5ea9f70406f0a446c670ff81c018a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258556, "uuid": "14a79952-14f1-49ba-915d-3e82bafde777", "comment": "Malware payload (Mirai)", "value": "9bd4ae57bfb24b802e3ff72f19e22c4759e87913c22a30857848dab57c10cb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258556, "uuid": "fa1f13fc-2efc-40df-92b7-6263a797768d", "comment": "Malware payload (Mirai)", "value": "69df8ba08f8eb9ba6873135e7f216efa4d3b6507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767258556, "uuid": "46a61654-9abe-45f3-ae21-7b38240272f4", "comment": "Malware payload (Mirai)", "value": "2145234c1738bad3e69bb30620c80ce90fbcb31433110bfe6d38e9b7afeaa33ca5cc0aef1ec844922fa7ef596d8f6e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258556, "uuid": "5ab5b28f-f7cb-4007-949b-3e2346be36ff", "value": "T1FE733B02B31C0A47D1A75DB02A3F27E1D3EFA99120F4F689651F9B469276E335086FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258556, "uuid": "df2796fc-8698-4c29-9220-ce2ff16fc47b", "value": "1536:54R3Wf5RLF9U6MBhSL55Gegv5dz66nTGCiz6H+:m3wnUdhA+v5d+6xX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767258556, "uuid": "b913a176-2295-4d77-9a4c-8ba9c432c671", "value": 73436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767258556, "uuid": "4b019e82-e352-4243-8af6-83abe9d8f11d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767258556, "uuid": "379279ac-4f06-4ab2-9f60-22bcbef84f7a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697557ca-e726-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767281261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281261, "uuid": "f5dd3402-26a2-4b57-ad2d-e2704c852249", "comment": "Malware payload (GCleaner)", "value": "bbe2eaec1077600f8d84d09b4774170c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281261, "uuid": "4776393e-abf7-486a-bda7-5b7fa056ab70", "comment": "Malware payload (GCleaner)", "value": "9c0379c891880398dafab7f296655d4d14eae7c858dd7bf130a922f87e4c08b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281261, "uuid": "5a7787c1-bd61-427f-93d2-f624bb57966b", "comment": "Malware payload (GCleaner)", "value": "14ef39cb214e3206d332960ccea91fd717afc2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281261, "uuid": "72201d10-e7ca-47c6-bdd5-7d4bcc487d6e", "comment": "Malware payload (GCleaner)", "value": "7e06932a4f2040b5eed921651c7647c7ccf542f211753cceeedcbdfea6e10f82fba579ec8309777c58efd5c692aff760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281261, "uuid": "44001a42-2605-45d5-8205-ca18164ab679", "value": "T17F36D000D250883DD338B2BB9F0D57BDD41E695EEAC1A48E37912F4D2A5C7DEE6109CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281261, "uuid": "c5b7fb14-01a5-4dd6-a66c-fb7235dc12fc", "value": "365dd928e86024ba833b1ea1cfbc5098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281261, "uuid": "b41e4849-c58b-458d-9e75-bff09843d00b", "value": "98304:/mRYFiWu6z4j1fM2WaCGjwiglz+KtVQ1v3DtaVTPLmf4aNIs2Pq:/piEzO1kv+jkVtVo3Dta1mf4aNIs2Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281261, "uuid": "5950ff42-952e-4ae1-87c6-e15718923569", "value": 5174544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281261, "uuid": "b37442f4-3f73-4674-b09e-6e697f7f4cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281261, "uuid": "6fc08640-8212-499c-b15f-60ae45f78f7b", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8115e4ba-e744-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294185, "uuid": "998a4612-7243-4d0b-a698-806f257eda10", "comment": "Malware payload (Mirai)", "value": "27520e43ccc1833a1d59eb8c97004efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294185, "uuid": "49c0999e-646d-48da-8163-8680b1612f94", "comment": "Malware payload (Mirai)", "value": "9e3a69713d3ad936430d9968529feafa4dad6e41bebee58d0bfba7cc080fa5f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294185, "uuid": "3db7be3e-51df-44f4-891e-bcc6935a2cb3", "comment": "Malware payload (Mirai)", "value": "1d90a371d1fe7bf0e7c5ee3653de440128ed3bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294185, "uuid": "fd7af0e6-1e90-47c5-93ed-645d6b1bad1d", "comment": "Malware payload (Mirai)", "value": "429ef8e24f663df3aae19f99576611a41aa49b3367bf7b9393908d5a5d43d69f6649de6ca92aacdd2468694bd4fdbd1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294185, "uuid": "0caeafb2-5a82-4d53-9495-47ccf1365d85", "value": "T19F534C01730C0A47D1A76EF43A3F57D1D3FEA9D022E4A989390EAA8592F5D3251C6ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294185, "uuid": "f42537e4-7fdc-4646-bf0f-07e1005be4c6", "value": "1536:9dNVhgk2VacL81oifrFT3rW01cHyj2qFhBpUUIGTP5eIDJ:Hp2ZErFj77gUIgPgeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294185, "uuid": "47cad070-89cc-4e0b-ba6d-cae6ca8dccdc", "value": 64432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294185, "uuid": "a5343ba9-9956-4322-8d97-0ebd1f0d44bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294185, "uuid": "b9ef4afc-d2d2-4b04-b266-5bac5e088abc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67963ed-e73d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767291295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291295, "uuid": "bbea811e-c711-41ff-b67f-b1bf87fe62bd", "comment": "Malware payload", "value": "cc5abc3a2174cb9f9ba4beb83c12dbbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291295, "uuid": "6cd196e5-ca77-4043-a6d7-ce82a951ef08", "comment": "Malware payload", "value": "9e68c857fbc16a9a78d4e59128e618563b67e621bf72f493eba01c0c8ee27044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291295, "uuid": "ff475382-4f12-4119-98d8-405cd8181f5f", "comment": "Malware payload", "value": "b46ec20d992b3bc225bccabe73174b1aaf7ea896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291295, "uuid": "9a765b0f-139a-4d29-9e8b-4872572f9e6f", "comment": "Malware payload", "value": "d140e4a4e1a6eefe35b38918ab462e2c46d771a5fb2547bb6beae5a68cef823660a601da57ece3d165289e478d07e82a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291295, "uuid": "0ab0a18f-2a9b-4073-b994-e650dc58e2bd", "value": "T14E64395DAEB58B60C7B40BFF8BF8264811617A03B1CF9305C2369374E948EE4ED499D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291295, "uuid": "af5b5f21-08da-4acf-8aaa-5ac13c10ae7f", "value": "6144:1aegIXrT/rkNNnjytONNpqGVc3w7VwE8z1vPQE/FYZwedC:Iepz6j/H8Uy5vNt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291295, "uuid": "fd42c014-2312-417d-bf65-fda86a105723", "value": 330679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291295, "uuid": "28b1292e-42c8-458f-88c8-9752ce741d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291295, "uuid": "37d945c1-2109-496f-9342-c2087a23ced2", "value": "bizy.riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756e47d3-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225876, "uuid": "98d99058-cf64-4a98-a185-c2e460a808dd", "comment": "Malware payload (Mirai)", "value": "3896dbed1335ae1d3c89cf6da9bea8c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225876, "uuid": "33b2108d-0dcb-4b82-968d-e40fb1848bf3", "comment": "Malware payload (Mirai)", "value": "9e788fb7de1ab3211288d95a35e27fc23ed833069a6fb01a3ae0e1370ada3fe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225876, "uuid": "3b4de3c5-3bff-4e23-b158-cd68e50e1818", "comment": "Malware payload (Mirai)", "value": "3cbe2be0c4f429d217bebef031e48c12141289c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225876, "uuid": "577cff97-2340-42e9-95a3-edf98d00b372", "comment": "Malware payload (Mirai)", "value": "6723c30ab87d9f2f07cb20bdd94b1a5fc7009046cb4e9f2eacd9ab4ff95fa3df14040b560cbb799b42e585353a57d15b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225876, "uuid": "4103ee66-0168-469c-bde1-664b2d2eabd1", "value": "T10483C705BF614FB7D89FCC3705B95B09289C960A21E83B3A7D34D818F25B24F59E78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225876, "uuid": "f875353b-ff08-496c-b41c-3fba1903fb4e", "value": "1536:BLP7dBiwqevwYHMSKq65JPcOj6zk6yRNGhWQfQxvu+7R:BLTdBwevrHxKXJPNWIxvu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225876, "uuid": "e5d06389-d44e-49bf-af56-7bf177bbc32e", "value": 86672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225876, "uuid": "4fbdc6ab-8de6-47cf-aeb5-5ae12ff179d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225876, "uuid": "92774862-642e-44d8-a44b-9ded260e04c2", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b501278-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292377, "uuid": "78811afa-37ac-4e42-a568-1a35c790c81d", "comment": "Malware payload (Mirai)", "value": "52d837f1fc66c76842dd8021b192a692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292377, "uuid": "25d32018-2284-481c-8c83-c605f066c8a5", "comment": "Malware payload (Mirai)", "value": "9ec1b3f1d5d4e398cacc63f45effab6b68212d4a6c775e0a01e4854e68b5c013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292377, "uuid": "edf117ce-2e36-430c-bdbf-77a77b239ee6", "comment": "Malware payload (Mirai)", "value": "ef1da6c644b6a492c5f443343dac94e56d9c06ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292377, "uuid": "4c49393f-a430-4b29-b003-6e26a6e3b43c", "comment": "Malware payload (Mirai)", "value": "3135fcbfa5ad9a55e50d7d82dfd466a5e45ad30285474ba6dcf870c4fa09959007da64b9c9623fe1bc59ce7303fc5f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292377, "uuid": "d6cd7dfb-bd42-46f0-949e-fc720462f09e", "value": "T13C63015EC0980984C775E97A8C239AC683F33FA0B256EFCDE295D6C01D974329B064E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292377, "uuid": "ff6a30a2-25c3-47e2-8e25-881f20f48399", "value": "1536:r4yoKRG0iZvHqoOJJ09R9PEPFKF6I0Qg3G0gs6NEx5XhjdMYf5/VT14u+qgw09F:ky1RCPYv0NMzI0j4sLd+YR/l14u+qgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292377, "uuid": "09aaf467-adab-4a86-9eb7-69529e6106a1", "value": 72228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292377, "uuid": "8023d92a-ad10-4a93-84eb-b4e8d55ce1f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292377, "uuid": "e9f393d9-cfc2-4ba0-94d8-6421ea152d89", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced5b94e-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767228173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228173, "uuid": "f1fd457c-424a-4987-b0ed-ad94f0f30814", "comment": "Malware payload", "value": "a077b84e458c3e01ecec446cde1c1117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228173, "uuid": "4f9d399e-cf23-40c1-89e4-cdbd2da5acb8", "comment": "Malware payload", "value": "9f390e6ade0364f43436219f37e7fb27ceee42a0cf6e50596cf61650c14fe726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228173, "uuid": "a3c5bf59-538c-40ee-9c1c-aefd616742a6", "comment": "Malware payload", "value": "00e0e2a941dab9f1146633f2fec70c572615a06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228173, "uuid": "e06e2807-1bd1-4211-b097-fd51ff9de6ea", "comment": "Malware payload", "value": "70a6de618163a55e02f6a0f910fd328c0211b0cda3c6851372319df669480e36c2cfd4cbef9613738befc04657e69200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228173, "uuid": "ad14515c-d176-4f9e-a0be-e5a57a973600", "value": "T130251283F5121FFAC4BBB1F548A35DB63A9DA8E547256FCA27056B0C3ED17944B083A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228173, "uuid": "05fdd1f5-5e8c-4bdf-a190-3ec89bb8aa2d", "value": "b538e4224cf15f19a61a8c8cacf778b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228173, "uuid": "ca60119a-75f4-4520-b0b5-a2e4e7577ecf", "value": "12288:H8F7oBvFeLHsCxcbTTaH/vXBsDYqrmYWfDJLuBsZnzj:H8OBvFaHVxcQKDYYRW7BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228173, "uuid": "29770df2-9ab8-4eec-ae39-0f3d73c07d7c", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228173, "uuid": "7772162e-a0a8-4830-a1ef-16d8422552d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228173, "uuid": "8e63cc7d-363f-4b2a-a05b-86d2106f4a46", "value": "2025\u5e7412\u6708\u4efd\u7b2c2\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f901f6c-e729-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767282452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282452, "uuid": "0d9d5d68-c2b5-458b-9e43-7d7b52fd0eac", "comment": "Malware payload (SalatStealer)", "value": "a5878cd78d7ac0a3b65393eae458ac03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282452, "uuid": "6d26951b-2a6a-4ad9-bf1b-49b0d68ea1f5", "comment": "Malware payload (SalatStealer)", "value": "9f9071b2d684217852e57496675112a4b9f224c575002fd1c95e9f8cacb23bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282452, "uuid": "fc8fc13c-8636-4203-886f-807b29ca7407", "comment": "Malware payload (SalatStealer)", "value": "12243554f840e9c3227d62a64651222f6cf6230e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282452, "uuid": "d90189d3-de94-4d08-be35-6b030f521506", "comment": "Malware payload (SalatStealer)", "value": "7b6d684917a3c9c72a07ab26536cd53a7a268ed73828aa0adb328d792bf0ddea742117ebefb68aee660572608d02e0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282452, "uuid": "355d750f-f361-4b22-bcec-1ed8c2098e6d", "value": "T148E533A754EAA583C226793EF0FB7D174662503A18FA97C54859331CFB20FC8C949E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282452, "uuid": "efdb5821-e360-443b-a9de-fec3a39e96b4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282452, "uuid": "c828dca6-1ec5-46f2-9dfb-2187b3ab443b", "value": "98304:zNjhD1cnuiMWCVfjVQt5YRH8FuT/YPfp:zNZmntMWChJ8ORcFe4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282452, "uuid": "73aae108-6767-46a5-a077-24dfa0628886", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282452, "uuid": "6640d511-fed0-4048-8f93-8969ab61b711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282452, "uuid": "8de573f2-09a8-4c7a-b0f4-9562e16e68a6", "value": "spectredex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77ac2d9-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295995, "uuid": "fa293a06-801f-401f-b21b-f55de795e2c6", "comment": "Malware payload", "value": "939a63de61d406a05617623e39d88c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295995, "uuid": "ed288f86-1a22-40f8-9be9-cd489f18592d", "comment": "Malware payload", "value": "9fb38903e7ede7f90e91269046033fecf669fd65dd2071dc0228f99886d040e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295995, "uuid": "9b7d2d66-72e2-4f5c-b14f-ed8dd0e5df2c", "comment": "Malware payload", "value": "ea301b718bbe29018601c54c837b33236191edcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295995, "uuid": "cc5fe807-b7eb-40b9-955a-f7019d9180b9", "comment": "Malware payload", "value": "c18be45d89bf066679eb895227b6cd8d65b5a1cf838eeff8cb2a17267368692726d017528c5e7a3a6af3381e6e1e8c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295995, "uuid": "05c1b96f-37b8-4885-97bf-a16921e1c9aa", "value": "T12E83865E6D218FADF7A886304BB74E31A79933DA37D0C685E25CD9002F6434E641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295995, "uuid": "ec5610bf-ad91-4e77-93bb-b6ef97bfc7dc", "value": "1536:X+DSUcyBvpnfptuHzwJViFmqQEeeTh1lf:XCcgvVgzwam5mrlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295995, "uuid": "2ee379eb-30b9-4fe2-94e4-119c905ce68b", "value": 85416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295995, "uuid": "cb90180d-7e59-44ab-8cb6-519a7adcd10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295995, "uuid": "67da82c0-3ced-4f8d-abaa-6c9137d1e831", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610741ff-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229278, "uuid": "ca268585-ceee-4c16-a23e-17f5b60263ab", "comment": "Malware payload (Mirai)", "value": "bf634cfb87038eb290302e6051837ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229278, "uuid": "1a72babf-6e50-4cda-b289-e213b94f1ed5", "comment": "Malware payload (Mirai)", "value": "9fec7c0867a6ff6a5f221ade1e7d507d2a6c2ce4096ccb814a7fdb76c38e03af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229278, "uuid": "b2e880a2-3070-4bc3-8450-444666cdbf4e", "comment": "Malware payload (Mirai)", "value": "da10984bdff15fa7d1199a6047a01925c7d60684", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229278, "uuid": "be034ff2-313e-4709-aadd-0758f8017dbd", "comment": "Malware payload (Mirai)", "value": "a21a19666c8e121c16953cac0d12b8598a150a0a952f77fc0f1ce7a380b9d90ef0836d9562b7c843c269d2ecbbda502e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229278, "uuid": "c400e022-7753-4ae8-98d1-dd0f25f3569b", "value": "T1C4437E4372184A57D5E60A70293F1AE083FFAA6021E4B3C5645FEB6A8671F371086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229278, "uuid": "cd5dd571-cc62-4bd0-91cc-0cdfb940ada9", "value": "768:C4O8kQlYyRCBwD4zsuTCS8nu2vnD4DIFc+Tv6BEgZz4qPQel00Z1vSn3Xi/lNuMP:CckAf7uvUWGvQEGz4qfRvSn3S/XuM7Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229278, "uuid": "fc3fa492-ca10-4bf2-a2f2-83d13e1305fe", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229278, "uuid": "8316c25c-f034-45b2-8d2d-d8d7e68b6e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229278, "uuid": "b2305530-6142-4cb8-8604-d71dceb3808a", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d633da-e6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767251358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251358, "uuid": "994a0c2a-1c74-4c87-b77d-f9e9a12865b7", "comment": "Malware payload (Mirai)", "value": "8c96ddce6c26e00b19df902ce943f55f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251358, "uuid": "0c4a00d8-eba5-464b-9e23-af2d5ffddf8f", "comment": "Malware payload (Mirai)", "value": "a0220487f781a2e83966474b1e24cfbfa0fe9a9ee11dadb65a3149c7e04a0302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251358, "uuid": "11687674-cfce-47fe-83b7-db2765c0508e", "comment": "Malware payload (Mirai)", "value": "b1cf34dfb43971398703922456419a2e17a815e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251358, "uuid": "b046529e-d402-422c-be81-d78f194386ed", "comment": "Malware payload (Mirai)", "value": "9b3d05f81f50309be89e680cf41629e9c7bd3d528d8d2aa431ad3e9755972c2ca8092507984d657a362c600876c61236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251358, "uuid": "583531ec-0b41-4ad2-a021-64193472bd87", "value": "T1B5030992BD834AA7C1E0237ABABE618E336263A4D2DF3727DC115B407B9541F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251358, "uuid": "d605a9d1-435d-482b-9974-3efa935bb2e8", "value": "768:Xl2WaUSqcpBISoUD3q7curDECwAxP0Ro/shTLKDcs0Rc3BX/MsV:LaUVcISd3Wce3hxP43G3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251358, "uuid": "191bea70-1f1b-47e9-8cdb-4fc1aa77d120", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251358, "uuid": "f6e46f0d-56cd-4dcb-b22d-d4b4cd0655d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251358, "uuid": "6b7a7571-a84b-46eb-86df-c4ea2fed654e", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068a9d18-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767291832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291832, "uuid": "7b74ce10-64ce-450c-8a6e-415465d1a3c7", "comment": "Malware payload", "value": "a4d80222cd9546f89b05bfca5e630c8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291832, "uuid": "d0711b9a-608e-40bd-b9d1-b44b9425eb1f", "comment": "Malware payload", "value": "a02c2092975c10068d16ee1ddb67a7fb33e06c8eaaf4ae8561ba38616e54263b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291832, "uuid": "4c87e4eb-0559-4ed8-bea0-1bf213ff96bd", "comment": "Malware payload", "value": "d454786a19d927cfb786cecfba0bdbfe08e9a4b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291832, "uuid": "48aa7999-3fef-43fa-8ee7-787ad357e9aa", "comment": "Malware payload", "value": "66779a76067894e41d726e9c9eb5bf8b364669881f343b4b013542ec05ef93b742f7c1fe1ea3813cdadd011cca4a3a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291832, "uuid": "adb5a8d1-9641-4fb7-89d7-94f706186582", "value": "T117534B42BC829602C5D552B7FB1E428C772753A8E1EA32039D29AF2177CBD5B0E7F911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291832, "uuid": "38b51165-4356-40a3-97ba-b445a66e4071", "value": "1536:GBtBjh1EsjzbIrRonskf5l0OTdDsv2M/vF:wtBTpMrRGsaJZM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291832, "uuid": "32caa9f3-cc9f-4ce9-a8ca-33fea5ac1f70", "value": 62036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291832, "uuid": "a36aed8c-4611-497f-b843-a94183b2736d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291832, "uuid": "34e46d36-0b2a-4cd4-b099-a8e462e367f0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed419291-e747-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295655, "uuid": "653e9e22-17d7-45a1-9073-cd4f70037791", "comment": "Malware payload", "value": "68ef1c8ad4291370998d9368419359db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295655, "uuid": "4f3d0085-d53e-4241-8e43-adc935891b3c", "comment": "Malware payload", "value": "a18e7f19d0f1ece9af566f6e14e1f5f2d1947aa4748e8f49c619a0a06d31b070", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295655, "uuid": "92c77c29-9fe5-44bd-a3d3-d3a123da0988", "comment": "Malware payload", "value": "abc230d9f5b0435c7eefea67700f512c93193e84", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295655, "uuid": "b22c7310-ccf1-496c-9280-78f2d67db101", "comment": "Malware payload", "value": "718fbde1ab8cd96a844c60cb76adaf2bfb675c9bc8db40c373cedee5aed55d27dabfdf72bcb6e661153255fc4598a7e9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295655, "uuid": "a37b2f94-c2f4-41c1-958c-6688bcaae9db", "value": "T190B6124E96C98932C0B11E3CA7B315C21B3D7EA14B58B74F9E84B64DA9730D0B93636D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295655, "uuid": "01927230-5f9b-4fde-b789-0d86ca17c51f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295655, "uuid": "5c598885-c473-4a86-b688-1ad3f9e618b7", "value": "24576:uLNJtI12iVuG4xloAc4Ye2bX+cAyFCoF/5bAHflcH8gen1rRH:2NJCp4PoAcV+cANo/5UHdcHpen1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295655, "uuid": "650a1bb4-7708-48c0-8e57-423af6dd4a4f", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295655, "uuid": "d21f8e78-6875-4035-b485-ee7cbeacd6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295655, "uuid": "dbaea381-5453-4109-ba66-81782fa4262e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637008e5-e70f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767271372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271372, "uuid": "06ad33d0-df62-4a93-9c18-917db1abe0a9", "comment": "Malware payload", "value": "83d878752ded93577e1d20705899bab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271372, "uuid": "c5e56954-b4f4-44f4-892e-d2c7cdf46752", "comment": "Malware payload", "value": "a1c7498d684376625623202a620c3e2b50a9222d8aeb1aa48ec1c7ddd9b526ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271372, "uuid": "edcc69e9-c45b-48e5-ab58-8e72389114cb", "comment": "Malware payload", "value": "763e4254b771df353b4eb010db89aae471fa5429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271372, "uuid": "d5d9ed38-e4a7-4426-801a-bf5c211ac9ea", "comment": "Malware payload", "value": "7168c8e54396145a832b7573a52d46b194bca408db6ec5a3f723a7a7ffdd54a56145363b1070eb6cf19af6483850da7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271372, "uuid": "5be5f1e1-3e2e-4342-890c-b76d5bf827b8", "value": "T150057C89EB87E0E1F66300F1025ED7F75538A12B8013F6F6EF452A6274727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271372, "uuid": "a6e3d9c6-6a7d-492e-8c68-31659362ce60", "value": "12288:RxAiW9hLPhx489s5YgOxbTavQYX+RBfByLDL1fkixvPyMDsICHMITm+CLu:RxAXhLPhfsi/bshuRBfB6hkENe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767271372, "uuid": "a416b204-dcb8-443c-a922-8ce1d5c7c3ce", "value": 856984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767271372, "uuid": "e2dfa844-99b9-45b5-b646-26a206d2ad5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271372, "uuid": "048b4602-e40b-419d-a198-5c24cec4b701", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f45b03-e708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767268477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767268477, "uuid": "d96286f4-9fa6-4b69-968f-1b8b1f440c42", "comment": "Malware payload", "value": "551ea231b497c2452fd996c5e7ee1701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767268477, "uuid": "8f4aa779-db90-428e-9f9a-01062d847007", "comment": "Malware payload", "value": "a24552ec3d7df4b49b9db11ef21d32f192f700247b28ec215f3b6cc441d5e1da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767268477, "uuid": "88460a06-d367-403e-99e0-f2bd2800a3c2", "comment": "Malware payload", "value": "fa87c06a7fbcc586ff7c5d3de85062fbac79942f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767268477, "uuid": "e508caa3-7c45-4aec-8fdb-0c804c106061", "comment": "Malware payload", "value": "329a4b4b376c58126b8340405ab854013416230b96753b2e5a0bf1cf0eac7333161797e55a2634e27415d11a434aa5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767268477, "uuid": "62c79dca-af39-4d80-96d1-d77a51ac5b47", "value": "T1E2F46B02EF890FDBC4AFCD30496E834F15EDC9D706D09775A1BC8988BA8D66A4AD345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767268477, "uuid": "f1c07f2e-5d8f-43fd-9806-b58c8491e4e1", "value": "12288:7TpqRYbVkdcSWebcnOQ53bjb8J8JOwwEj5HX+z3OCmv2pLoxvTukTU8YvhHz6z8p:ApHorL1ndt2lwOGdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767268477, "uuid": "9a64ded8-7c1f-411f-bfe3-c1c335791201", "value": 729932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767268477, "uuid": "733760d0-2811-4732-9bb8-b3ceec84e6a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767268477, "uuid": "a5338bfa-0a6f-4e68-ae34-085edc3dfa10", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac689135-e70b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767269777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269777, "uuid": "eebe8910-b318-4f00-b3a2-a309ef47f182", "comment": "Malware payload", "value": "798ae93ba6479389ca6f67aa9f59a284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269777, "uuid": "fc8e2920-0af0-40f9-917b-645c94605a7e", "comment": "Malware payload", "value": "a2553a5d77a997671f3d01ddb01dd1730f5d4b9eb5f9f014406b64deec0602cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269777, "uuid": "f4c186a0-94fa-4f78-a930-e1d6a939cbe6", "comment": "Malware payload", "value": "cf10e14612216dd3656f3fca0b17d1fbc09015f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269777, "uuid": "1f11c3f7-947b-46a3-ad40-00298ff31fa0", "comment": "Malware payload", "value": "31ca3cbe1bfe2cd40e1fecee174b20d717a845ba53708fb88e33727b180923647176c84dd53bcc8080b22b3a3cae75d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269777, "uuid": "6cc5a14a-20e7-4631-bc8b-82226ef73a06", "value": "T170086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269777, "uuid": "63ba15ff-48a4-42f3-a3fd-a90bef8cf627", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269777, "uuid": "cf730a5b-eac5-4265-b3b5-541456c6015b", "value": "393216:0s/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+L:0EYGD7sJYgNukUB4S5rs3wbpLLNNPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767269777, "uuid": "f7584f05-a5e9-4715-aa22-f7b78efdf2b8", "value": 82197386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767269777, "uuid": "f7385df6-7278-4a34-8504-c4c84504e703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269777, "uuid": "a1ed90bd-37bb-4590-8202-d9615fe71cbd", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef591130-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767231664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231664, "uuid": "76a9f961-09d5-477d-80e9-0184d14f3e1a", "comment": "Malware payload (Mirai)", "value": "37d22c09ab4af26f032262ade2c52285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231664, "uuid": "4d0b917a-0b28-4e16-af3f-44e23dc33a6f", "comment": "Malware payload (Mirai)", "value": "a2a9ba87bb209afbec2d8d3915123b442629bd1b3c1f83adf3c62d8dccaa7245", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231664, "uuid": "81ea5501-ff43-419a-97a8-f72d74f0585d", "comment": "Malware payload (Mirai)", "value": "f95261953ff3fb6addaeaac2ff00ba8d1488db08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231664, "uuid": "586a4a1c-cd8a-452b-9743-05f4773c1515", "comment": "Malware payload (Mirai)", "value": "5f64f4a5ee274c455c3553ab60c824569aca20c32627ba2c0002be401182b6ad6fe26e344dd2a73dd5cabec87000b098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231664, "uuid": "a23b4de3-ca4d-4ffc-bbab-d73fa7167a3c", "value": "T1A9048C73C8641ED8CA2494B0F4E2EF795B23911590476EFAAAA7C2B14087ECCF5097F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231664, "uuid": "853f8d5d-921f-4d90-9763-1ccccf6d7a33", "value": "3072:HL/JSPb1/8duBKjTgDOGXDwPeo+6p2abdRPW/+wzoe6hh1uv:HVI/XBqTGjcPeoqGe/FoIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231664, "uuid": "a0097952-e7b7-4159-a97c-478d411573e1", "value": 183364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231664, "uuid": "65435e1e-322d-45f1-b906-f7907f5326ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231664, "uuid": "43641f37-4518-492a-a93e-557576827981", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb26267-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292410, "uuid": "2a6d47c1-62f0-4917-8382-c79aaf1af652", "comment": "Malware payload (Mirai)", "value": "dd49dfe5c87499e8a54022b69e7fb641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292410, "uuid": "18923587-8559-4252-85c9-853dac0476f9", "comment": "Malware payload (Mirai)", "value": "a300d533634a1dd58e4985ffa7e5509d25a4ff2c38de263fa0d35def92e37adf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292410, "uuid": "c3ab1822-48d5-4aa9-b5db-38ba5c48bc00", "comment": "Malware payload (Mirai)", "value": "b202c629025c673b29ed872d0b0832c2730f6567", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292410, "uuid": "21435807-de1e-426a-aa86-cc457f1ae00f", "comment": "Malware payload (Mirai)", "value": "6ce121e6f54eca8172b1a5275b457a874aecaff7a909dd3b22cd7808ffc6223f4e4dc1c499d8aca04ff5e820e59a628c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292410, "uuid": "8f287e9b-165c-45ef-ac14-463ff970c477", "value": "T15FA32B82BC918A5ECAD017B5B6AE268C335263F5C2DBB213DD104B5537C994F0E7BAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292410, "uuid": "91848e1a-5591-44d8-aa31-ca88c0862e8f", "value": "1536:cDE6B+Lpx1e207OBeFOAt7VnihL/8sdH4Z5zQsHQMRlkI8SqJurnLw62IymQY2AA:cDE6UL711m8z8r0TAlZrrnf6hh10yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292410, "uuid": "aededbd4-ddcc-4a89-a753-7c9771ae8b41", "value": 100772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292410, "uuid": "c413d013-583c-427d-ba17-a0048feccb7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292410, "uuid": "42da91e6-3690-46f3-a23b-e20530b6fe8d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f677cf2e-e70e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767271189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271189, "uuid": "e4bca813-4d44-493c-8516-885321e2f20b", "comment": "Malware payload", "value": "0017c8e3054589d2b3d11278f6c23ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271189, "uuid": "ca9d7bce-385e-4b32-a481-f974a6e051d3", "comment": "Malware payload", "value": "a3073de7f7be0a2b67c076d291e045dd24f1f2d13080557a299bc482043df6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271189, "uuid": "6e4c1d48-9d80-4e1a-b6f3-3358eed17157", "comment": "Malware payload", "value": "299a6478e6d408ae583b642eb21e94c554e006f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271189, "uuid": "5f563259-abcf-418c-9156-733ccbd630f7", "comment": "Malware payload", "value": "4c92aff3648a7c82e776f3b6dfeeeb9f778a1deebaf0dbe0593abe6c06d238653d2f9cb73cfe04464bbde9b11f5f74d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271189, "uuid": "194590e3-1672-4a60-9fef-713decc24750", "value": "T1B025336765464FBAA7E19B3CD04814CAF3B8DB742A3EA34961F4D7710683AE3C5B9C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271189, "uuid": "7d103439-1867-4cdd-83e2-609d09ed98c9", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW4q:EpCKabVQ+9qlNlpjN8Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767271189, "uuid": "b53e4f3b-ec0a-4b4d-8371-b6af2375158c", "value": 982780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767271189, "uuid": "49d2f071-cef0-4e2e-95a1-782f77452bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271189, "uuid": "0c20cb7b-d5d3-4ab2-a17e-a11cfd558a96", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f2b84a-e70b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767269573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269573, "uuid": "f818ea17-c62a-4f12-86f1-414ca96fcff9", "comment": "Malware payload (Mirai)", "value": "e6cc767efbc754e170361e4868d52818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269573, "uuid": "ebed51d8-6623-46a9-bf08-943a5a7eb9b1", "comment": "Malware payload (Mirai)", "value": "a31c290b388a56d228f60d1a4afccaff1c18722710712dbe718167bf227c786a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269573, "uuid": "f08d5c79-fbce-48a6-9374-3b1da68acbf6", "comment": "Malware payload (Mirai)", "value": "671a83065eca5e800d9143dc3bea08b053f40b12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269573, "uuid": "2eaf1bba-8162-42af-865d-c7a2945b6f86", "comment": "Malware payload (Mirai)", "value": "002a85ef391cbb8b267783bc16bbb7ce1fa229e54c3181ed9bc80a4ca16bdd7cade9865ac4d6dd1b8a6075bdaf0cca6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269573, "uuid": "ac11476a-a36c-4e89-ad7f-5d64003cc8f7", "value": "T157244B56BD91DF11D5C221BAFAAF418D33131BB8D3FA7102DD206F61638A99B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269573, "uuid": "978dde01-6903-4242-885a-616e700b2487", "value": "6144:4UfmaqjNv4d/YntvuzDztzEA5acIJYRoUatoHGj7jU2v:/fTqjNwxYnFKEA5arJYRoUatz/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767269573, "uuid": "e963d7c0-01d6-4537-b894-8d0f393df6db", "value": 214144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767269573, "uuid": "3a814569-6593-4018-869a-2cf84d5b685f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269573, "uuid": "f86efc0b-fe39-498a-8acf-5bba57f59850", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbca9bad-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767229483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229483, "uuid": "ec317019-fadd-4820-8702-32fb3779a9a7", "comment": "Malware payload", "value": "c55501a0be3d8854b96801dc74663c92", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229483, "uuid": "0929d40f-9fba-49ef-99e1-66fad83a1539", "comment": "Malware payload", "value": "a327e7bbb66761412650c0ada49f53b8fe45f754855b555baa185b61d95c60bb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229483, "uuid": "c96ddeec-e2b4-40e3-805d-008cb6383723", "comment": "Malware payload", "value": "aa2dc07a6e75f7cb9cd203080992662cc85f9e2c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229483, "uuid": "917a2a00-90e9-46be-99d6-1b1121f70f04", "comment": "Malware payload", "value": "9c7a1bb600fa002afe3400d3504db04df1db018eb94560634e46c13aa70bcb5502ad137d62c34123c1436fd9912c3ca8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229483, "uuid": "e9487ae9-e5e5-4bf0-963b-046df80bef9f", "value": "T141E1C686ACF324087407906DCFBFA2583069A057874ACD9CFDCC65A8DF4C2A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229483, "uuid": "88d86863-e595-4fe1-ba22-e0b7e3f4e064", "value": "192:OZ4ZIE/CTK/eL0llHYoHsfOBro2Tc/OsSmy:O6//NYoHsfO2/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229483, "uuid": "6c7a1c10-efb6-42c2-98b6-0de9577eb75a", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229483, "uuid": "1522dd39-1673-4869-8111-348345daca44", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229483, "uuid": "ab476e39-2f37-4ac8-a55d-699fb839381b", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae44d53-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292913, "uuid": "c945453f-21e0-4da8-8b66-f991cddde07b", "comment": "Malware payload (Mirai)", "value": "a7d306e81c30c7a991222ceb5ba10449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292913, "uuid": "aaa89f51-660d-4008-9e3b-8001266e58a7", "comment": "Malware payload (Mirai)", "value": "a36fef1ac8b6572588585f39f89ca16667398246e6e909685c8d76a2696c54ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292913, "uuid": "07e3147e-4bc9-4b61-af51-07cc817a545d", "comment": "Malware payload (Mirai)", "value": "62ab79411975714ba034480e23f9384e1f4e169b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292913, "uuid": "b82bb9c4-f839-4029-9563-8a923105c5dd", "comment": "Malware payload (Mirai)", "value": "fcd5a2d16528c8afc985cd7be0e545f4dd8f4d95b3588885b15e78350ac320e4e44605c531bd4e655d59944a44b1225f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292913, "uuid": "27a7d898-c4b2-4394-9a1b-cf99f578346e", "value": "T1D663028BF036A471E1653036E66D474A635B25E4841E7B4B382C03482DC7CA6E5ECBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292913, "uuid": "42b1a18d-bf5d-4f66-ae66-e26e1d9b813d", "value": "1536:eNwFFGJEZZp8fYXFca8x3JogfXqmxlteB6zutwgHu74RTSplzs:eNwqJEZZp8fASz1OgfaAlAczqGsG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292913, "uuid": "1c9ca6e4-b14c-4118-b764-d5854a164422", "value": 72988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292913, "uuid": "f17e4487-42e3-415c-be6f-41b1beb4a407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292913, "uuid": "bf6a88f1-5c21-41a9-830e-7db39cd776d8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabb54ba-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254741, "uuid": "b8f432e6-4ef8-4cb6-86ed-54681f690b50", "comment": "Malware payload (Mirai)", "value": "8224db6bef73d9716ca0e3f2db47a15e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254741, "uuid": "8ffd916d-7bb3-4b5a-b091-e2efb7443fe5", "comment": "Malware payload (Mirai)", "value": "a438ffb10ea3becb4c73479c32cbbbbd4bc10d9fb0b6b7b9f098a10ae0edc325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254741, "uuid": "d07e1eb7-be8d-4cef-bdee-168477a55331", "comment": "Malware payload (Mirai)", "value": "d6278d58cc6288dbc024954aa841836598dcde17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254741, "uuid": "4890beb7-0b38-43c3-b2f0-12371eb389d9", "comment": "Malware payload (Mirai)", "value": "6038ce3273c48ebc4e5ab2c8e0caf5eaee93fbe46d5260711addb26f14b15a4e728fac315943b130a16e3089c268d2a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254741, "uuid": "390ccaff-62b6-4084-b933-3b0265ee6207", "value": "T12213F22941DBCF6146B040BB4FA98A4296B7842AF39D77611778EB303C41759C6BC2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254741, "uuid": "05f34d7c-031c-4a20-bfd6-456d08f38722", "value": "768:YT0YMK/Ajl1Sk8yE9vqxOtuVWETIGr2D44KQxVk2Tlgja2+TNkEos3Uozt:YTT/aS4Oud0jDALN+RkEdzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254741, "uuid": "0035b958-cef3-4b34-bf0a-066f2e469dfe", "value": 41972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254741, "uuid": "4427f526-4143-41c2-82e0-2906ea328b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254741, "uuid": "38104006-619b-43dc-99c9-24e6e0cca7d4", "value": "m9x7k2v8b3.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de264caa-e714-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767273726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273726, "uuid": "1a2811c4-7c64-45dc-b71b-fc1c9e0bd9d0", "comment": "Malware payload", "value": "5d25f99e92f18e0468f0870cb393100b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273726, "uuid": "937eb90d-25c1-49b5-9999-e1a530a77a4b", "comment": "Malware payload", "value": "a4a7ff6a5cb01f58e24fc753b7cbaa6e87248e2f8881af5a77a1ee35cefb3be8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273726, "uuid": "f641f4af-d2bb-4887-a157-5a8cbd22f696", "comment": "Malware payload", "value": "3a21786344840a3089d09f2e62219ee29ce13ddc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273726, "uuid": "07101b96-cbdc-4087-8a3e-ba01d76b1c10", "comment": "Malware payload", "value": "3f48e815cd1d740eb3c54abe3c0916702847c0c3a59027bef9c016ba14e5e48202b7872c308d819d9cef071da27e4a14", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273726, "uuid": "40429bc1-bdf5-4c52-b585-9b9e7d7e260e", "value": "T190E1C786ACF32408740B905DCFBEA65870599057474ACD9CFECCA5A8DF4C6A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273726, "uuid": "6682cb0b-6938-4226-96a0-6f8e0b3f00a6", "value": "192:OZugNIE/CTK/eJWE0llHYoHsfOBro2Tc/OwSmy:O8K/XYoHsfO2/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273726, "uuid": "a3add7a7-abfa-4be2-8c88-2df03b7cd45c", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273726, "uuid": "4b32bb48-fc3d-4721-b444-fd4ea622c4d8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273726, "uuid": "e130c7fe-b9c4-4329-a52f-38e685141987", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d655d27-e6c1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767237915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767237915, "uuid": "b8b5802e-77d8-4451-a56f-61454a4a40d5", "comment": "Malware payload", "value": "871d82784f99f36ad9f2a542cefe6d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767237915, "uuid": "64e35835-fb7d-4ac8-b997-d1c7b0cfa7df", "comment": "Malware payload", "value": "a4af8f3b1fe0f428a0f0f0add035e27607c5dc8df3dd223368995aae694d9724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767237915, "uuid": "066bb3a4-366a-4131-8182-0160be123465", "comment": "Malware payload", "value": "5292654e3b1516ae3b00d3cd66639948ff0d133d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767237915, "uuid": "363f2f30-df65-4955-962b-ceb84665bf68", "comment": "Malware payload", "value": "5d7df6f24db70f0778c491d4745ed29d6544fa83bac7449bf1b2081b0aab55bf9c581e490a1bf12f2dffe312fde5f7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767237915, "uuid": "3b220c77-3dd5-4887-a724-95382b9a0f85", "value": "T1D0B733267AD190F2E1B71D710E18A1183B9A5C31CF11954FD3D86AE59633B82CB292FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767237915, "uuid": "3d8a8546-9952-4cc3-80ed-7b2c6d17d939", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767237915, "uuid": "f17192f9-cfff-4f5c-96c8-11ae00aaad05", "value": "786432:nwrORgrwP1hGJ444aRcIlYpGaFHtLTR++UN0p/we2N6dc+96FBFtiGpR+kos+qNC:n4Ofzp44pIlYltPRom2sdwfiw+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767237915, "uuid": "791e06d1-c066-4747-9439-6e629ea27a85", "value": 48388412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767237915, "uuid": "0aafc1f0-2bef-4f85-8cb5-259e512a3ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767237915, "uuid": "5c4c6150-276e-47cc-9968-a02a445f4e7d", "value": "\u5e74\u5ea6\u6536\u5b98\u62a5\u8868\uff08\u5b89\u5168\u7ba1\u7406\u90e8\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96db1d31-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225932, "uuid": "48392711-9be2-4ea7-b870-a2f20e04a784", "comment": "Malware payload (Mirai)", "value": "e16851dc0813e07e272e66159d6e4b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225932, "uuid": "0d9dc2b3-12de-4737-9910-9b245069ef75", "comment": "Malware payload (Mirai)", "value": "a4f42ef96cb30007d2ae262d4417eea1dc5e53d8ff753fa06d4fdb86425dc026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225932, "uuid": "7c15a9aa-b754-4c54-a245-3d0af473f685", "comment": "Malware payload (Mirai)", "value": "5c31dd783e9e57dc893898b5ece7df16f28ad694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225932, "uuid": "cafd74b1-783d-4ece-b9b1-ad3c2f905f4c", "comment": "Malware payload (Mirai)", "value": "23f47613ce9af4beed529dd17e8b371f8b6b0effe8090637d4b3c9c8a10db9e04685022ef57ae316f1312882c624b8cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225932, "uuid": "5b4ada83-48f1-42fe-9853-23ba1b41dc65", "value": "T1A6244A07B5C080FEC499C1744BFFB136D972B06E123CB29B6794AF222E4DE605B2D695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225932, "uuid": "0e083d6f-48f9-4990-a268-3a966fe48a26", "value": "3072:tBOxwxkgr0a8oWOg9yMCu5R/cGWA3nsKGz6Gry1/Rtnc2qNneKww/8jxjUTh2x19:tBOxwxdr0vopWclGrYk/vnUn1wBlEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225932, "uuid": "4a89a193-86d7-4c0f-9d34-5875bfbec2a7", "value": 213808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225932, "uuid": "2134f376-0b54-4bc6-816c-841e1a59817f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225932, "uuid": "693add5f-abb7-4f09-bd1e-db69fa8cb8f8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acab4f36-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254745, "uuid": "e7cd952a-02a9-477b-a46c-0ddc0c694044", "comment": "Malware payload (Mirai)", "value": "95aa4f9dacd1a42fc7af1c07df46c61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254745, "uuid": "01f89184-b0e6-47f0-bca8-f80bb8e9c323", "comment": "Malware payload (Mirai)", "value": "a4f605c2274bb2aabae86e5b5fb0bfe540353981dcb49b4f3a57ae4fbfb64c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254745, "uuid": "1eb2af16-2ff4-4d60-9de4-359b4f3527e6", "comment": "Malware payload (Mirai)", "value": "300eb79ac33a06223b78f094f8b52cc860387f4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254745, "uuid": "154d4a3d-7455-423e-8ed1-f349192ffbb8", "comment": "Malware payload (Mirai)", "value": "90538d6c4681f65ff419944ba15276f91783f66109a2eda0b7dd14acd578dcfcea63ea8c97409fc4d60460c01e8e3c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254745, "uuid": "b6e01697-44cf-48f5-860f-741554de6716", "value": "T14103E131E44C8BE7EB7F95E81F8C86C6635519A2367FC4831A12AB02677B562710EDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254745, "uuid": "bb640cbd-482f-4b69-9195-cfbf092d2b98", "value": "768:oXwlzie4GncDW+sDy3ld5g9CMD7aYXhTxShoDxMgUelaRf4uVcqgw09A:oXwKGnh+sDMle7aGVxooDARf4u+qgw0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254745, "uuid": "81bf2260-5544-4406-80b8-7542490449eb", "value": 40516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254745, "uuid": "26a383bd-2fc2-4d77-9143-dd591b54354f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254745, "uuid": "e37a20c8-4dd7-47a2-a64f-a94f61baacc9", "value": "m9x7k2v8b3.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21199411-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228311, "uuid": "7f841a03-6be2-4314-b868-163d30a32e3b", "comment": "Malware payload (Mirai)", "value": "0f1abbaee92f8012338cb41a84995187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228311, "uuid": "d2ae5255-f9a8-4b99-b5fa-02b91e3195ef", "comment": "Malware payload (Mirai)", "value": "a502198e5939baca3a98fa41901e51663130801311d177930ce3cdad5e6fff3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228311, "uuid": "1683ef2a-c0cc-4545-842e-da476e47b92a", "comment": "Malware payload (Mirai)", "value": "e82611f5e7c88353648617c60d5077cb0c489484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228311, "uuid": "54912367-e187-414e-a1b7-9510fa04b43d", "comment": "Malware payload (Mirai)", "value": "c50894f238b8c7b82f6dc9b6bc36b7c2022db389770d4dd6dd7ddc4c93065d861a4ccc5fa36637cc5c68064436c29cba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228311, "uuid": "5f514cd7-b1df-4364-9ac8-5a60d4dd547f", "value": "T10053D71A6E259FACF76C873587B38E319758339636E1C245D15CEA011E7034EB81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228311, "uuid": "5081a35b-47f6-4380-ab06-91081f99969d", "value": "1536:/E6xT0VCJoZc6cH53GC4YENsLbsAprnb87beR7bba37mvAoeuD:swT0VCJ4c6cH5WGbLbsAp27mooeuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228311, "uuid": "92508e89-a4dd-40e4-8cd7-0f8245151b40", "value": 63544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228311, "uuid": "ac4cbef0-70d3-4d09-a94d-dc15aff56ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228311, "uuid": "4158975a-52e6-48bc-b244-021bd92e4fa1", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f7e2d9-e71c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767277202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277202, "uuid": "ed1d4c50-3b96-430c-93c1-12b508b12987", "comment": "Malware payload", "value": "090b70f57b131afee10b67bff5797a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277202, "uuid": "b355d1b6-e35f-4258-b1f3-6e18c24cbb7e", "comment": "Malware payload", "value": "a63a31183b75090fa02ce0b6b4e7d102e519845fef81eb846643cb049761e24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277202, "uuid": "74585bc0-0539-4b4f-9b5e-842d1e604fe7", "comment": "Malware payload", "value": "e5bc3c97196777f0dceae8ecc588e2fe4bec4126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277202, "uuid": "df7594cb-0692-476d-ab6e-910d7583b66a", "comment": "Malware payload", "value": "0d8f429a16a7eedaf1b0f69ae7eb99d49dda08cb786b58030b102efdd74e739c38f272f2e49301a3ea734b11d9d5da43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277202, "uuid": "799ebba2-b8aa-481e-9ed5-4a65945c5a7b", "value": "T14FE64B57E8E25AD4C4EAC271E12A825BBAA27C091B3823EB16D0F3301F377D05E76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277202, "uuid": "598accbd-83cd-4288-aefc-6dcb5a780ab5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277202, "uuid": "1d36df21-67e1-4289-8d82-b842cd4195c1", "value": "98304:1A0b6gqEYfeGT3PyBxF/Cd0pBGPcFw7OpjpXE:1fbjqEqzTfyBx80pycFsO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277202, "uuid": "761f00d2-7eb6-446f-b53b-1c93e21565b7", "value": 14322688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277202, "uuid": "ab20dddd-eb82-49ac-9fb3-e4aa97d6ed7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277202, "uuid": "44cf2870-1335-4bba-bd5e-2ab8a25398fb", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bddafe-e729-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767282763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282763, "uuid": "9b476833-60aa-4ff0-aa26-8ad9946e595a", "comment": "Malware payload (Stealc)", "value": "c4f3243ed341eae051a1dca15b19cdb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282763, "uuid": "c6dd196c-5560-4ed6-9039-3cc2ba7fbe4d", "comment": "Malware payload (Stealc)", "value": "a671b06da890fdc0598db8a9102c51a81dd2b59c3b9e51cd361c7de7a7369040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282763, "uuid": "bb12797a-f3fd-47fd-a21e-0b24f4b5530d", "comment": "Malware payload (Stealc)", "value": "e5d88fa2997f4408746943a16f72c6ec8a705275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282763, "uuid": "10018d20-617b-4b40-9b05-bae0f0b2f4b5", "comment": "Malware payload (Stealc)", "value": "f9530af422f66eb745d105ecc9dc9bdf281c897dfa0f97f7cb2fa2d8b2e7de0aa53f92baeed29cc4b38708efcd5dcafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282763, "uuid": "1590214c-155d-4ff2-b638-eb490afd868b", "value": "T1E5C597F0AD01D8C1F57E5B7BF2ED7908A1343227EADD5A4A00A466591EF6A01FD0ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282763, "uuid": "b4146e1e-c427-4368-b101-525c76a69f43", "value": "66506cf48bfc3b0d79a8e3790223e69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282763, "uuid": "bff42f5b-5722-4c6c-8f22-7c8bf9e8dfd4", "value": "24576:0VX9GM3LhbNz4W5ZqXBs3ysIUHBN/BzBL93Ri:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282763, "uuid": "01064ec7-5952-44ab-b3f8-570e94297e14", "value": 2558464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282763, "uuid": "5f10715a-16d8-4a1b-856a-68c10a6976b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282763, "uuid": "5a2670d3-9c96-4032-a85a-5b2c1a0399cc", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f315d6-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252801, "uuid": "4bed90c2-482e-4dd4-985b-b29fc0e9fb02", "comment": "Malware payload (SalatStealer)", "value": "83a93137bfd775f842c872971b57d8af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252801, "uuid": "f02aa59d-7f70-4fb9-8b1d-b86fb072c1d2", "comment": "Malware payload (SalatStealer)", "value": "a695a76b0d2b0d357c8543746a9668fb26498a9c5b7b305581e717c5b7d9782b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252801, "uuid": "7a56b72f-9bc7-4f26-b154-47549d82583f", "comment": "Malware payload (SalatStealer)", "value": "302a8af6fc42a059126d908affac3ab8137ec998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252801, "uuid": "341ffa7c-c809-4014-ba9d-e2f172318adb", "comment": "Malware payload (SalatStealer)", "value": "75b59b2fc3398a74ece817bcea7cb03372ddfea1a6a435ab43fed382d32d1482ca82151cebfd2c07d0f9e7ee0a5319d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252801, "uuid": "0ca8fa8e-93df-4a87-95aa-b96e03d178f2", "value": "T194C66B01FA8B54FAE9031835405BB23F67355E048B28DBDBFB543B6EFC77691192A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252801, "uuid": "c556392a-9803-4d68-b259-b0058de48a8f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252801, "uuid": "3a4e1cd4-33f5-4d4b-9b91-5f40fe4cb3bd", "value": "49152:x7/T6IkVFfJpXLa3/2iZUdRSoVW4oagcBNXZ4kZgNRRhwWdvgOIgST8B7JlXpw5G:FL65V9+3/jUdg1k+vpVdMbrbPZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252801, "uuid": "08468f5f-e85c-43c5-9971-ae8f5727c67f", "value": 11663360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252801, "uuid": "4f81f18c-1e86-40ee-aa86-09c121a470bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252801, "uuid": "5503399b-40f6-4f80-88fc-99c68b935599", "value": "6c1fce048dd6807e55ba57958a602c5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090d45d7-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767297420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297420, "uuid": "afe53425-2ed1-4d00-b547-22d8c26f9920", "comment": "Malware payload (Mirai)", "value": "06d9b891149f0439e0ea08ec912d9d59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297420, "uuid": "8982d1cd-a517-48ae-bf03-df4ee5e7dcfa", "comment": "Malware payload (Mirai)", "value": "a6e8a6cba75f2d56dbe947012faaf9a1c148c163c83078434060bbd7e7cf402d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297420, "uuid": "9ab1d5bf-6805-4593-9aff-f80c02f00136", "comment": "Malware payload (Mirai)", "value": "90db97dac287bccb1ba5d9d0bedfa096bc23cf61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297420, "uuid": "aa36b346-2731-4238-920b-df38e272a8dd", "comment": "Malware payload (Mirai)", "value": "85784eff2a9491754f177f5b16f6f0c0ad701c01b7499e0b6ed89088c0c796d793ce1b0e4b17bad63559039d9e8b0bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297420, "uuid": "2e41a453-7463-4599-8f4b-898126292dd9", "value": "T18A5302512AB8E83ECEE2C4390F6841BA86DC4DE46493501E53CD7DF88A06D68FA9C5D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297420, "uuid": "2dc281d1-a460-4a9b-b506-a4e748210367", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/ulYAQV:MaHJgMo8FwOA4zUFGUO3UhAFQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297420, "uuid": "ffa97228-d633-4190-b1ca-65f752b845ec", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297420, "uuid": "768ac8fe-6d27-401c-806e-ae8405138ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297420, "uuid": "a3e23f79-be7d-4f3d-a92a-27c4c59107aa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8561435-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297794, "uuid": "ff650f37-5ddd-4a13-94cd-8ad89db44e45", "comment": "Malware payload", "value": "42068bded3660909b8bbcda3a4d39ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297794, "uuid": "bf37ec2d-eaed-4c77-8c8c-40e4cda1e8c9", "comment": "Malware payload", "value": "a79ebadc5811cebc14ecb05080aacba8114f68b1b2aec7122468538c557cded7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297794, "uuid": "6a941182-c530-4cc1-8c0d-03638ccfd9a6", "comment": "Malware payload", "value": "b542ee543d33596bde9a9a7f52df09732ab528be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297794, "uuid": "b2caba6d-2782-4917-aa13-e11aa42f8f2c", "comment": "Malware payload", "value": "1dc4579cfa77c85958e398b61d8959f0e925de1c69bfccd0c4df1ebe79d028ce5451c6ac4cc833b7559487aa2aec5f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297794, "uuid": "aa7bce57-d286-4d9e-9f7d-d890283c64ee", "value": "T12FC44B59F8809FA1C6C5257AF75E829833134B79C3EBB20659245B343BDB86B0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297794, "uuid": "3761fde3-328c-4b01-88be-6d9adfa8c86b", "value": "12288:Ivxog0Xskh4rTAfpLKDyf9cIJDgpZ6mN+lH:I5Q+rMfpLayf2IJ9aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297794, "uuid": "4fc267a6-768e-49ae-b320-68c25a84f751", "value": 553636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297794, "uuid": "ad24c618-3de3-4be0-986b-ef5d333a435c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297794, "uuid": "8c64abbf-8fef-4d49-8422-a29224ed46d2", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39a0cb4-e718-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767275399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275399, "uuid": "2fc4c49c-7ec7-44c3-9e17-2b4594862aa3", "comment": "Malware payload (CoinMiner)", "value": "0df8b3f70f77999304cdacb5160f1044", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275399, "uuid": "907f4f23-5f63-4bdc-a6fc-3bb337f4b7fe", "comment": "Malware payload (CoinMiner)", "value": "a7d83ade8be0566749dd9844197e5877d2ad763e94e0f2b407b0172f12a9973d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275399, "uuid": "1f6f075e-6554-4569-9db2-287d7413493c", "comment": "Malware payload (CoinMiner)", "value": "d4d11c7be6fe1f4e16b80313e5eaa1d38f41f80d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767275399, "uuid": "a411df46-fb9a-4018-9010-826460161732", "comment": "Malware payload (CoinMiner)", "value": "c52ab49120c8fbc9050ee9174240d07fb77077975bbf5fc73c04a93518fbfed28691760d176c45c0fd8366d9629e6ad7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275399, "uuid": "a2f957e8-fc7f-4960-bbe9-11e0ad06ef8d", "value": "T166C7335933D15CACF9A152305663C2007BEBB42D1328C4DB5AECAB52FFA35711A35EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275399, "uuid": "33da2ccb-df21-4498-982b-5acb8620c74e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275399, "uuid": "d367926f-6432-4200-85fe-43a6e3dbcdb1", "value": "1572864:xEWX3SCVLl/nrDt5kzcAV+/CyH1YVRHe8IlRLUfe:xEWXRV9ndyzcAA/nVYVIrfUfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767275399, "uuid": "0fb2303c-a54a-409d-900a-c46f2d1f5a0b", "value": 56708593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767275399, "uuid": "a24ea2f6-2b36-4ffc-a04c-136edafe75ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767275399, "uuid": "87149468-79a6-4cec-8460-741142d0158c", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5cd3a2-e74e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767298363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298363, "uuid": "918279ef-eed6-4105-98bd-495e7ba6ec66", "comment": "Malware payload", "value": "5062169d3f767da35a8e654053d5f9fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298363, "uuid": "6b4c10c6-12b4-4f8e-9359-90495d7d0fa1", "comment": "Malware payload", "value": "a8062f50057c4d8be86c50b411addafa7429b451420b3aaeb1ec6f04aef18957", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298363, "uuid": "400374ca-c9c1-407f-8a22-67affc514c9f", "comment": "Malware payload", "value": "f60a853e199ff4756ad96b931838247645487250", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298363, "uuid": "a5690c02-5a32-4461-ad28-c49342acdd06", "comment": "Malware payload", "value": "a499c2be51b28236ff6aebe63bc884c7a35f0b6d9e043241475831e0748eef7f4c28f2936a8d262b12bffca7d4420a44", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298363, "uuid": "681e0806-7755-49d5-825b-501f85800c7b", "value": "T156B5E005BB989E0EC87791324D4A9631601AEC27CB53C387DD782B5D286FAF44F513EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298363, "uuid": "702c4106-ba34-4758-950b-41c0093fb090", "value": "49152:Jy6cb3W9QI1cpI/N6hk4VG9yKanGgroqhQ+O:Q6e3WwpIn4VG4K0RoNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767298363, "uuid": "11d71c88-3aef-47d0-968a-cb62c0200a7c", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767298363, "uuid": "e3642e26-d30a-4967-8c47-7b8a7f426b21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298363, "uuid": "ddc55f2b-1d89-4d98-8af8-972b2335c0c1", "value": "Chrome (11).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf04f3-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226432, "uuid": "e259dee2-4b6c-4725-b48d-4844e79b8af7", "comment": "Malware payload (Mirai)", "value": "2b62daf3bd2dd7c68c981314ead1b09b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226432, "uuid": "ffb0b0e9-3e92-4ff7-836f-a12ff10650c2", "comment": "Malware payload (Mirai)", "value": "a854e2d60895fe7a6458654743f8f815ea1a4d15ba39426008693c2f30992234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226432, "uuid": "884210e8-6ccc-4296-92df-48f5f018956f", "comment": "Malware payload (Mirai)", "value": "a9937ac9a49f2ee1045951edd487c9d4cd25544d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226432, "uuid": "d3c826e2-a16d-4809-a780-c3d43acfefd9", "comment": "Malware payload (Mirai)", "value": "5ad77efc6415df4fbdad87dbef302d5bd60a6681e373b9679bdc2061385061691e633c49bd7ec43ec527a46e81e2c099", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226432, "uuid": "2409074f-0211-43f9-9eed-3cec1e45cd75", "value": "T18B137B72C43FAEA8C54857B4B4708A785F93E500C2531EFB5A8989758083ABCF61C7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226432, "uuid": "435fbada-935e-4cb9-8348-55b9e9cf2aac", "value": "768:w4aiwtP/oBb0e3UbtcZo9Pk5TrJrdA1aamijUACiopQViCw5Nu:7aiwtPHWytnPkpldgPTUAiSViCwTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226432, "uuid": "d428d11f-126b-4e92-91b3-30d50c5c9764", "value": 44056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226432, "uuid": "bd5b5563-ab26-412b-9632-cf74d9c38ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226432, "uuid": "8d5ae217-94f5-4dd1-b973-6cdddda50f36", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f118e49e-e716-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767274616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274616, "uuid": "fb86e58a-83e5-4cf3-9c55-6f553790a128", "comment": "Malware payload (Mirai)", "value": "9d0d812c8289022ef6661d245292cd71", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274616, "uuid": "6b58a76a-07a8-4124-aa05-d4bbeba85711", "comment": "Malware payload (Mirai)", "value": "a8d35c9ad788b7ce2a5327d4e0716c956bd7310407313c96e378d6549df18acb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274616, "uuid": "ced15396-8d86-418a-8ef5-1d2b20577717", "comment": "Malware payload (Mirai)", "value": "3ec917df77e75af1fee9ed296271a39ab05203a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274616, "uuid": "862e6892-c09b-4b05-b8a4-2078062eef9e", "comment": "Malware payload (Mirai)", "value": "cb8d37098e75e802f4dddf6d3b4952ed4713f1b0bfd21bd2f1c0a4f30864fccab6813ef7345fb8dd4a75bc6226a751a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274616, "uuid": "93aacaad-5039-43ca-be33-297fddbeee0b", "value": "T1AEF05B9F2068EF13C1CC4E567AB6603F547183D91966075AFFE6409B54CD600376CD95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274616, "uuid": "430f4d13-fac4-472c-904f-036c2ec79fcd", "value": "6:SdVbkbHI67VxKSe3DjdVQlcQhXdVeag7QtvG3VcFGNIF8QdVcf687Qvv0:6GDDm3DjdAMaguiVNIHGk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274616, "uuid": "08742507-ccca-477a-8e35-c7f0c00b8d52", "value": 491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274616, "uuid": "75732354-2e3e-46f9-9d70-76faa14397a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274616, "uuid": "0a85fe7c-1dfd-4b9b-8ba8-a3a5634afdc6", "value": "po", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633b944c-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767229281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229281, "uuid": "2ac752ec-0885-4df4-b6d0-c169e38c3940", "comment": "Malware payload (Mirai)", "value": "c22dedb029221c0c9b69ddfbaa8eab0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229281, "uuid": "8821de9c-0161-42a7-b8d5-766a859ec2b9", "comment": "Malware payload (Mirai)", "value": "a8f4ccc4dc6250ba2366a93603a082f0710d3b4851bcd0656234bf1c7a74142b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229281, "uuid": "0b7d0cc3-06b2-4633-a708-79ebc386d6ac", "comment": "Malware payload (Mirai)", "value": "5b96d4e243fbdf539dd244a127b3a7cbea8e7faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229281, "uuid": "c8d5d7c8-f6ed-4c4b-9a07-761127456a7d", "comment": "Malware payload (Mirai)", "value": "0edfc0f3997d44cbcf3fe028f3f6080fa8097e97f10f38e15f7e490ae531215c0ca3e716d057e889f93e1c2f7b759d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229281, "uuid": "264b818b-f4fc-4413-b8c2-99d112a612a0", "value": "T1A5631985F8C745F5C84B4A3460BFF33FDA31DABA40305A6DEF59AE21DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229281, "uuid": "852b99f5-8cc3-45dd-ae2c-0bbb2ee4496e", "value": "1536:+UzrP7BIluOdSIvwi3WwMYXJp6lYKONM:+UzryluOsi3a8JoYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229281, "uuid": "80844219-767a-44ab-bd3a-7b5e31ff1b23", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229281, "uuid": "0669c0cc-1bdc-4a6b-95f2-4e112450a251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229281, "uuid": "8efc6106-16f1-4975-a890-4e2911745c6c", "value": "KKveTTgaAAsecNNaaaa.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476ad5b8-e748-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295807, "uuid": "e9dca943-ddca-4630-8338-f06952d109f4", "comment": "Malware payload (Mirai)", "value": "97df8c2b91e4133853c82997bb369ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295807, "uuid": "cabd58a4-30b9-4008-8a6e-b0f3b21e8c81", "comment": "Malware payload (Mirai)", "value": "a8f92d9f915636565063a420619c9fcebc520711aca117aae4c2292d929ccc2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295807, "uuid": "b07ed5a5-9095-4550-a8f1-fe4e74f19153", "comment": "Malware payload (Mirai)", "value": "8f2f46c3f979f9e1ada72224382d228e77fbd85c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295807, "uuid": "19f4deff-dc04-40b5-8dde-3a5aece34ae7", "comment": "Malware payload (Mirai)", "value": "5f99802ed20a2489203b646afef6becaa9bce7f0d5f50276e47f327ecdc2192d07a28e4e1b50818075b7362a78d70b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295807, "uuid": "5eca7a08-c212-4d42-90d5-892c3d4ddb1f", "value": "T14FD33A56B9919F11D4C731FAFB9E418933535FB8D3FA71019D206F61238A99B0FBA202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295807, "uuid": "57329a39-93c7-460b-b3a2-0e2109692685", "value": "3072:YHg5aEd4UHYza1G7VqavS9i3IC77svvei45z7sv5B7b:YHg5jd4HW1KYavS9i3ICHsvMzov5hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295807, "uuid": "ede7157e-b5d0-4eaa-bd04-6078f5016dac", "value": 133408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295807, "uuid": "a511a542-f97e-465f-bf7c-2b8cd81932e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295807, "uuid": "ff742da0-48dc-475b-8f67-232f986207c2", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345ba6a7-e70b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767269575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269575, "uuid": "3714756e-9e30-4af6-89c5-b7f16e85befe", "comment": "Malware payload", "value": "70d79be2d68028e475ffc44d00ffdfde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269575, "uuid": "134e668e-fe05-41bc-84db-690699188e75", "comment": "Malware payload", "value": "a9ffe578da0a77a16cd055f9bcb1f5f107e3d610b6294ff0d769cb48fce8fe81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269575, "uuid": "162cd4e9-5dcb-4be4-ae23-056e7c7a7d7a", "comment": "Malware payload", "value": "0703871b871cc4080fa13bb9ec8fd9809be57ff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767269575, "uuid": "4811b7ca-d52e-4808-84e7-f5bc73fc0919", "comment": "Malware payload", "value": "ac32b2379eaa3bd88826fc3e85bf1ccc9e41ab92a830913f9693c4fbfdf6c73640890f927e97e9df3875de87a41a5402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269575, "uuid": "231fec48-11da-44f5-b734-484011eb1282", "value": "T1B2F46C637B218FA4E325D67005F38B555A9522E21AF390C193BCCA107A50A7E6C5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269575, "uuid": "b82a51f8-13d5-4030-b7d6-7512d01b5be9", "value": "6144:AoXotRQdO0H4kKd/SEKmlB0XllNLQah4LQJ4aFTQcdPozsxjJ7pSddFYTAtp2+u5:UsUkOWlnJ4gTdgsdSHDpNxFgpZlZfXw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767269575, "uuid": "f42f4be0-22d7-473e-b100-5f5fb27ba226", "value": 729932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767269575, "uuid": "869014b6-840e-4f6b-967c-ac04b5995c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767269575, "uuid": "d69b0d55-caee-4ead-9076-055c18c6f615", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1ad095-e728-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767282257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282257, "uuid": "448a29b4-9208-405c-be95-282663ce31f9", "comment": "Malware payload (SalatStealer)", "value": "cca81ee045650fc552b1427defe29866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282257, "uuid": "838a6e8b-e1cb-4051-a3fc-359613ed7ae5", "comment": "Malware payload (SalatStealer)", "value": "aa6907ae13c10a632d4ce4ebd863fd8348c77fb3b40b89f5166158018fdfd2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282257, "uuid": "d9491ace-8507-47c7-9bbd-829685f1d630", "comment": "Malware payload (SalatStealer)", "value": "6ef4f65e103cb325dfd6ab961d1bd2a00997a046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282257, "uuid": "de9b31ae-ac8f-4317-9731-f74b4ce53ade", "comment": "Malware payload (SalatStealer)", "value": "fc507e1f0fcc228aa6d5c35aea1c3027ba9dcefb79280f0d5b27f5f2b5f3a9dc803091fee0895231d263f9c62454e4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282257, "uuid": "626a709a-768a-4b64-b7de-cc35e852bebb", "value": "T16CC65A51FA8B54F6E9071831805BB33F63315D048B28DBDBEB543F6AFC77A825926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282257, "uuid": "f9b3d39b-3fc8-4ec4-a7e4-10633245767b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282257, "uuid": "0de67d62-18b2-48ee-b7de-9798de3e3f19", "value": "49152:h6j8tzNfYyvSwKNKvb7hKCRJEqbSPKQu4Zj4j4vurRNY9iF7a6Rc0bAzjMx6R85N:oYt5fLCKvZKCDhyWT9lgGO+fLPZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282257, "uuid": "f36191f0-faf1-40b9-a8ae-ae3c25e6961b", "value": 11663872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282257, "uuid": "7d0b587b-0031-4243-b717-8932f66a597e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282257, "uuid": "17e61994-58ba-4901-8763-d27dc48137fd", "value": "GHUBPATCHER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60e5d65-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227353, "uuid": "5bfd52e9-0585-4979-b119-59a148e7ed94", "comment": "Malware payload (Mirai)", "value": "9b0a198c6529f9532e81aa50bea676bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227353, "uuid": "2024815f-9dc6-4968-b71c-939fb68a0283", "comment": "Malware payload (Mirai)", "value": "aaad6701db91069fec98a1c113641f8ef3e8c62f8594846614847b8defbb9de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227353, "uuid": "32ed7263-ceee-4500-a6be-3a9a9f72d65d", "comment": "Malware payload (Mirai)", "value": "37937b7f1043a17882df89598050c2b37b9e8b4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227353, "uuid": "565786a8-4865-4603-b79f-69843eb08e85", "comment": "Malware payload (Mirai)", "value": "e35a2e54a8f202abde627a8da9e20c7f7cce764aaec17383b6a7441bb7a7f2f117e4f0ff5b9102d903a0841e5a6c8914", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227353, "uuid": "cc63d7af-200a-4434-8646-8fdc4891c270", "value": "T17B936CC4E383C4F2E95B01B29437F3365332E83A5019EB96D369DD36DC92950EA1A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227353, "uuid": "c0466c20-d952-4c96-9718-5f6976f7134a", "value": "1536:DPCfZDf59H+lNWJ/TWsjsdjlvd2H6FkBhSXXhn:DPwZL5NgATpUBvdo6eox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227353, "uuid": "5d8244c3-2c64-4784-871c-11a6f2a29f8f", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227353, "uuid": "acef227e-dec3-4c39-9e26-8771206e31ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227353, "uuid": "9ddbc60d-c7e4-4420-ba92-6dc9d4e30142", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ed8218-e72b-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767283271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283271, "uuid": "760ef5d2-a74a-4fad-a536-0ef5b2184da8", "comment": "Malware payload (MaskGramStealer)", "value": "692476e7da5e53e9adf200ba894bf92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283271, "uuid": "a111f7ac-1ed8-4ae6-8335-4394b8badaf9", "comment": "Malware payload (MaskGramStealer)", "value": "aac2f6e0c4bce2ebdffcf29de85a7c46effea19e561597e127204f34f26a3493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283271, "uuid": "ce67f85e-7e64-4e80-abf1-21d84e34f9a6", "comment": "Malware payload (MaskGramStealer)", "value": "3ad213be89f6251e409911f31e926584ddf81077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283271, "uuid": "3d45e49c-9e40-4634-bb51-558e18f5f7ce", "comment": "Malware payload (MaskGramStealer)", "value": "92e9da17a0a1dc24d56089dd45f2d3e86a35f0f07f42bded97876335de1ac881cdcfc964b621ab8aae506cf5a3a26653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283271, "uuid": "5a06d3ba-d042-49d9-af0e-7a6857992dd7", "value": "T1C704D0395D78E357F39CD0F6BD658FC2A821B1940FA1A323DEA9DAF097024600A5C7E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283271, "uuid": "7db78c20-43f6-49b3-83b9-f7571ce79316", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283271, "uuid": "ca9cf563-e8c1-4370-bc39-2fca7c0e3b39", "value": "3072:2Tj31qTPJC4RcTXvIDadUlT0a8o/x8Lv6dOoAK6DWFH0rh:29qTPJh6jXd5ixWv6jLFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283271, "uuid": "f4150890-ee3b-429a-9ba9-e6cd1a7fb294", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283271, "uuid": "7d1908d9-62c2-4113-8202-273bf48725f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283271, "uuid": "caf07132-82fb-4514-9a24-a99a23fbf1b3", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5e7707-e728-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767282229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282229, "uuid": "fa3f48e6-334c-4418-a401-045eb102159c", "comment": "Malware payload (SalatStealer)", "value": "16632576b8fc4849b63bed220c98f6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282229, "uuid": "44b85749-a117-4006-94d7-6288a081e763", "comment": "Malware payload (SalatStealer)", "value": "ab0582929697e19ca4853b4e8aea836dc8481bcd3f4dfe1b42b20264d2042c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282229, "uuid": "6adffc69-ae7d-4ddb-8284-5aefc14e0362", "comment": "Malware payload (SalatStealer)", "value": "44a7e2c889488a012e0c3c381236314fb72c07cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282229, "uuid": "40687420-57ea-4635-90a8-c7e75d304d69", "comment": "Malware payload (SalatStealer)", "value": "3e1669625afda421a493fad8dcab5a52e80a11e3915daaf04236f6b19fab1783d42fc0fcf8197c4e9dca3302ff047178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282229, "uuid": "c2b05935-5d53-4821-b51f-d30a6dca7759", "value": "T125E5334AE9947A00CC8FC6F96EC7EE6CBBCB1B62B51002AD521705A0655735F722FF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282229, "uuid": "e605b553-bf17-483d-980d-e0d4b78336dd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282229, "uuid": "a06e5f92-9225-49e8-affd-eda187756865", "value": "98304:wx7/SjUqFU+BmJzxfeCW38PWHtT+2LBd0Bt:E7/K/C++xfelmWM2LBd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282229, "uuid": "415300b4-f0d0-4e69-9b00-2756f45a435a", "value": 3293184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282229, "uuid": "bdfe40f5-80e0-4edf-8e1f-15124f68f272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282229, "uuid": "ad3398e8-75af-41a9-a6ea-ec63aa46f083", "value": "GHUBPATCHER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1f71c2-e6af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767230071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230071, "uuid": "0950ef57-1348-43e6-8395-db1747fd665e", "comment": "Malware payload (Mirai)", "value": "96cf9777cca5dcc75c70844d09e5b746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230071, "uuid": "a44cd3a4-4cb1-494b-8383-e12632243a4f", "comment": "Malware payload (Mirai)", "value": "ab4cc779f3e4c090729aceab57a39613ae91c656110eb063d8bf0ee537450620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230071, "uuid": "a37e99a3-8936-42ce-94f6-81d7cb6b5619", "comment": "Malware payload (Mirai)", "value": "373d5f6e9a2e2f0561d751d3f6f2e408dac87059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230071, "uuid": "005d9fea-15fd-4503-932c-240a1058bc58", "comment": "Malware payload (Mirai)", "value": "7aa38410f4e1b713629949502ee238a351e23bff2aa42a036821ea2465694651897eecfcfe63ed8ee9ae033511dc13aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230071, "uuid": "c924c8e3-9dbf-42dd-812a-bb99e593675f", "value": "T1F87302698366C46CE35B39386EAE807FA517A77890DF35620F443FACE8C768194744C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230071, "uuid": "3f584eb0-4a82-46a1-9059-6e50bd849ec2", "value": "1536:9wjnkONsDNO/fGSBOMxWD1DRcZEtX4p+VNDow6Zlw/Ye7jZRWA9nPL5:9wjRNsDNYPOMIZtX4p+0wAMYe3+0PL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230071, "uuid": "4a0a06bb-b3e2-4f87-a21f-2626f46587cc", "value": 75864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230071, "uuid": "15373df1-dc36-4315-b239-cac01a67f305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230071, "uuid": "765cb249-c039-4fa4-81b1-84c4f3967b9d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552b3e92-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270489, "uuid": "c8d5135a-cdc8-407d-800f-8d996e9e0a7b", "comment": "Malware payload (Mirai)", "value": "8931a0c05e1094fe59134c6f45e3bbc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270489, "uuid": "d2977627-85ed-4696-985c-3ac9fc2b34db", "comment": "Malware payload (Mirai)", "value": "ab823a7dc6aef5d5805e649200959600b24148ac0573a3156c98639642f455af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270489, "uuid": "8f80033b-2da9-4cbd-bef4-5f6b633b1eb5", "comment": "Malware payload (Mirai)", "value": "2032f9446accaf4d4d3cc9bf7ae3ea986aa8fe8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270489, "uuid": "9e438e3a-b174-4ded-89ad-977f71ab660f", "comment": "Malware payload (Mirai)", "value": "b81a10ba5a717c8136461d5f844898291580d87dfe3de449e7da9f005df6e9065809c036d7e380686b2fd21f3634c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270489, "uuid": "af16725a-0f94-4257-9a83-584cae0758ba", "value": "T14A43185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270489, "uuid": "8be0bcfb-05b6-4f27-aea6-9ca5fb23d66c", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270489, "uuid": "30628571-d0a4-467d-b390-6b146b38023d", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270489, "uuid": "8b807f28-55d7-4ce4-af3e-e3f65ec6647a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270489, "uuid": "7fe4e5fa-05f8-49d6-b394-09f7b9842d9e", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41c4dd0-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226437, "uuid": "4adbe2bb-be8c-4184-a992-82ccd1e3ecee", "comment": "Malware payload (Mirai)", "value": "09e351027c636d0a72406249d515f7c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226437, "uuid": "51204eb0-fd5a-4035-9d1c-e8ee3f7264e1", "comment": "Malware payload (Mirai)", "value": "adae9297dc97636bc2ab4ab2534e0a753be3d0bfd5cc1195222934f9313e48c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226437, "uuid": "792237c6-f690-4600-a6ba-fd610634df90", "comment": "Malware payload (Mirai)", "value": "694a2522c40a21424f9a819cded12197ad7b4581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226437, "uuid": "64e520db-1096-461f-93b1-1fff5847f7b9", "comment": "Malware payload (Mirai)", "value": "c74ea80e676ef6cec9df0163c09b6bb07293d1a2be53eb0789c834014a0750c2d0c6eb374c7053513c5bf2fa414b4632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226437, "uuid": "f5eade5f-9eed-4ec7-a434-907086cc72f9", "value": "T1DD234B99A401AD3CF94AEA7E84130E08F630335521D3073B67BBFD936DB22A45D16E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226437, "uuid": "f27ce93c-3690-46e3-93df-ac938dff033b", "value": "768:6beIklHs8Do/70Ko+rM5zR49XbA8SiORJsMK96vNHr8:C1k5Do/ndM5zRMLA8SfJsMI6vNL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226437, "uuid": "05ef782c-1968-4117-91d1-54b2d3737b4b", "value": 49384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226437, "uuid": "1b7a48ab-0694-419e-971d-42f21c27f3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226437, "uuid": "70e20caa-4181-4afc-b62b-685728bbd4bf", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d2d1e4-e72e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767284642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284642, "uuid": "933b094c-75e8-4b46-8770-2ed491564dd9", "comment": "Malware payload", "value": "47e4f741016ad18e757df0cf709fcb52", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284642, "uuid": "84c6f6be-66bf-4bbc-b08c-c7582cecdead", "comment": "Malware payload", "value": "adcedc557e9e4df71317e6484778301ed16571da6f40a95d698f6508b7be00ac", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284642, "uuid": "8049cda4-9eeb-42ec-97fe-a1eb07efb655", "comment": "Malware payload", "value": "0498edd617232eec7f06b3b560e7c2b99b09856b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284642, "uuid": "84682a10-cb91-4bfc-82b0-a59b416fb955", "comment": "Malware payload", "value": "860c008741872764e296b3350b76c0156dcd2e82e9c6b300a47bff6d53939ab427d2443bccd20a84c5ce7d025b3900cd", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284642, "uuid": "e5a72fd4-ece9-4964-94b2-0af5f973fb15", "value": "T1B18723E8EEDBCED8AD9DF8703CEF13C0685095CAF127844552D9D6B8F243A170A815E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284642, "uuid": "bfb9f7f4-7ba1-4f90-9335-cff4e71a854d", "value": "786432:GayUxJrDZugrBxDKR5AwCMxP3LagBQQMZgyEv4qZf/gd+or6Dwm9JY2ULb9TD:Ga/jrBuabMNugBQzujv43d1+DwOJYBPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767284642, "uuid": "fbc34af6-d470-460a-85e5-0ba390159cf7", "value": 37332091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767284642, "uuid": "7e1f94f6-87b6-4252-b9c0-315857325e75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284642, "uuid": "de08b823-035f-4de9-adb5-49ea6717f67f", "value": "Flex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed20d09e-e6e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767251846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251846, "uuid": "276565b4-907e-4da8-b9c4-fcb80fda8de6", "comment": "Malware payload", "value": "3ce32c915141ca2b2e8d5686a6b3e337", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251846, "uuid": "53d4a203-20c4-400e-98cd-4324edb8f70d", "comment": "Malware payload", "value": "ae4f4f599b070507f614b3a2f285667db0757e6b18a2d3eece485d1182040e95", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251846, "uuid": "02d64f7e-18e2-4f7c-b9d1-ca36cd2d27cb", "comment": "Malware payload", "value": "797b36b5560cb207b8db6b1a7e52615a53440584", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767251846, "uuid": "c7733bad-fbdd-422b-9789-9a9d812eba0a", "comment": "Malware payload", "value": "e8db055f5dd0db3698e1ee5be9e3cd042b67dc0fb0aa1454d20a368e0196ef14d0046273822c8c3dc0d94ffc3e903e41", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251846, "uuid": "3dbe0ca3-9ac2-420b-bee6-fb331f81d56c", "value": "T199C15DBA49D6A93FCD06D5BC05504E2135764DFEE0EF419F8AB04056DFBA40D150782F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251846, "uuid": "c2b8744b-c7b6-4987-acf0-fc9d3fad9e83", "value": "96:WW54rGDJ2Uzzab1A/WxCK+cHsYRcesBnymevWKKsxGHtQ9K9OjctUIfH:wyDJbab1A/mN+gQxBny3zxwQ9jctZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767251846, "uuid": "bc0ac84e-7a40-4f52-96d7-2a64a95af7f2", "value": 5634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767251846, "uuid": "90b56a77-3744-4bf2-9ffa-e811d6ecc7c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767251846, "uuid": "e1cc854e-c880-4046-9e91-6a53c1b18fb5", "value": "CDN.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f63a373-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226993, "uuid": "25a7f973-16a8-409b-9777-20b08825c544", "comment": "Malware payload (Mirai)", "value": "7fd29d67e406e9458dbb1be1d7d6ce16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226993, "uuid": "ee7bb95e-c42d-43a2-9a58-3d61457c76a4", "comment": "Malware payload (Mirai)", "value": "af07becb4231bd07913d643bb686d2c1b1ec390e360c3aff52fedeb07684c3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226993, "uuid": "b31aae6d-5ef6-480d-abde-85f2623abd60", "comment": "Malware payload (Mirai)", "value": "a1d95329f99b8d5f92610b24460c5b3d06a92427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226993, "uuid": "3b5efead-73a7-481c-9e78-cbbf8554bcc3", "comment": "Malware payload (Mirai)", "value": "8ad4a239a206a367fc1df0b9f7828c197a40bef29867d578375e57e906bcd4b183a8ea43f3b38efe150b8cab2a03f469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226993, "uuid": "c0b7f8bd-1bdb-42d1-842a-ad9ea47ec54e", "value": "T12983A60A6E219F6EF768C73587778F31D788379226A1C281D16CF9015E6434EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226993, "uuid": "92b20e8f-7542-42f2-9a26-ad81dd5c90d5", "value": "1536:cQtYoXdSTQZ0W8CEjEyq6pam2PAlULOIPS3k/39t/33opTXe8S5u+7RiZ:bYsddKaL3CjLet5u+8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226993, "uuid": "e60bb0d7-1945-4ab8-972e-5c1300848d09", "value": 84800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226993, "uuid": "bfda8575-cf2f-49cb-96a9-31e6ccc0cc16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226993, "uuid": "4e4a1a25-26bb-473b-a777-c43c44a383f2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e864b0c6-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295647, "uuid": "b5bde307-e6d2-4af3-81c1-382a62bc45cf", "comment": "Malware payload (Mirai)", "value": "d72123594a7c49b4a9d1cb42e5fdd25d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295647, "uuid": "082c7c66-bd1f-44a9-b8f7-dd419023dc70", "comment": "Malware payload (Mirai)", "value": "afa23d73b6a1510a4a4cc2edda51831e78cdacb0ee55e4b082e1402a54bc8afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295647, "uuid": "4a9a8d03-b137-4801-9975-652b3fe4e7de", "comment": "Malware payload (Mirai)", "value": "d8670901de9918d747dc4e4c66fc20ee7216caf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295647, "uuid": "a2e2351d-9e1a-4a2b-aab3-20bc5e6bfeb0", "comment": "Malware payload (Mirai)", "value": "c861549af5d72e0c25ea663bf2d954396ddc0bfed75c884702a7f413e0e1c5523e611c08db8b9dfb12c270aa63f3866c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295647, "uuid": "a0fa37e2-3421-489a-8230-82ee5a729312", "value": "T1F8242C42F9418E12C5C112F9FB6E518D37136BB9E2EA7202DD246F60378A8EF0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295647, "uuid": "316aaa38-e65f-41df-ac3d-149a5a0d3088", "value": "6144:/BlyAhLEREHKVAbW58fyeifKNwODuxEHK1geZHsWYiX3zEawO+sU0eKpryAb:/Bz+REHKVAbW58fy5fKNwODuxEHK1geS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295647, "uuid": "e0b827de-b039-4976-93e5-f3d40c762e69", "value": 218632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295647, "uuid": "6f1ff7b0-b80e-40fb-a390-858a061ed548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295647, "uuid": "dc7009eb-111e-4ae2-b96e-42ac7af66c5a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a352d6f8-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226812, "uuid": "c83d39f9-d452-41ec-9821-4afd0cee40ce", "comment": "Malware payload (Mirai)", "value": "697161b3a6575c753dc4d4ad3afd6aaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226812, "uuid": "bda9bbc0-57c2-44ad-aaf4-4795bb657eba", "comment": "Malware payload (Mirai)", "value": "b07f58657e0dcda56ceafb9a420ecd311f92b31f7adc35a7a7214e9ce74555e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226812, "uuid": "76a89e17-0985-46f8-8fda-80655a3ddfa7", "comment": "Malware payload (Mirai)", "value": "0b8f2bae1a34938c5dd5962f9c3dd577c228221a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226812, "uuid": "d482765e-aa09-4380-a42d-b12caa9bba1a", "comment": "Malware payload (Mirai)", "value": "7a03b538ec5b1b76737bb098d45b25a514c875e1c4857e14ffdcba6560d558635aa64659ac5bfdfb7ee7541d77f2b2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226812, "uuid": "7860f804-ebed-4931-b5c6-b113ae7962b7", "value": "T15D93084AFC819B25D5D922BEFE1E018D33535BA8E3EE72029D105F15778A82B0F7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226812, "uuid": "e6c05542-9141-4956-8351-81cfbae34676", "value": "1536:tRnRaDhYysSscwOE0UoqZbWDs9bulHweRO/smn18tjbuQp+8BJqwllO4iadRBmuU:ED2yGOE0URZyD2OHweR7mniFbuQp+8BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226812, "uuid": "d707f5cc-8190-45e0-85fc-26fb0b756e67", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226812, "uuid": "e22c52a2-3904-41e3-b953-1c0083dbb455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226812, "uuid": "2c798fe9-34fd-4539-ae49-67997f8598af", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5685447-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226090, "uuid": "7d04f5d8-fea0-440d-8090-7a3262a9e5d6", "comment": "Malware payload (Mirai)", "value": "c11bb0bd805fc3f02373ce4f3db141f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226090, "uuid": "b9dcc00b-199a-4ab1-ae9d-3fda0438a409", "comment": "Malware payload (Mirai)", "value": "b0c29851199ae1b40493dc2d78b72364e644f7d77bcb6fd89b520ad87b459c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226090, "uuid": "8c28e96f-b540-4506-a123-0b9038d5e8f3", "comment": "Malware payload (Mirai)", "value": "4f71c6b798a25f271869309afbc572f9522c545a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226090, "uuid": "ec34b656-9e87-4a2e-996e-3d36dcdfab1c", "comment": "Malware payload (Mirai)", "value": "843585b760164b26942733c295736fe42dde72d1b69b2f88c27269c7d92a7dffccd4cd887226b57674a76bb0fe6a4df9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226090, "uuid": "803f5a04-4408-4866-a728-bb9bc730b087", "value": "T150234B21BEBA5C1BC5C5643A21E38635B5F5430A21B8CB2B7E320E9CFF54550235BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226090, "uuid": "1a811893-c3ff-4e77-b345-593000493c71", "value": "768:UfUZeFCvMHIi2gopzhpI7HnoGsO+p2ace+ch1x:UfUZefIi2gopU7HnKnce+chH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226090, "uuid": "c461dcca-2c3f-4c8a-a3b1-e59109bbb8a9", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226090, "uuid": "eb6a2f6b-bed4-4a15-9a6f-a88559fbf011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226090, "uuid": "f7abd741-def1-42cf-88ec-835697603725", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ba80f4-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292017, "uuid": "7126e9c0-85e2-4430-b693-f73be56082a6", "comment": "Malware payload (Mirai)", "value": "a3e50a82b7a9a85ab5812a77fb68ea04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292017, "uuid": "0c73bea3-d097-4f31-b6e6-f62757a43b6f", "comment": "Malware payload (Mirai)", "value": "b236f74426dc67025c84b8b457a8e3ced557d6efeebb8e2e69578785025dd0c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292017, "uuid": "64f6282b-7aa4-48e8-9b7d-263ff3ddfcbc", "comment": "Malware payload (Mirai)", "value": "4203025b127c088c3014c037a78cefdaf189b8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292017, "uuid": "7c164b8e-5c5a-4df6-b95a-8f27c72b3937", "comment": "Malware payload (Mirai)", "value": "ce84ba0c6105b13508c4894f3e56d161d220d5e8ee95f2df936d674d1602cb36a64d83163e3e1a32cd6c504bb8880988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292017, "uuid": "a2f1be5a-4656-4487-84c8-e75ba95c0ff8", "value": "T19C53020256B6C6D0C8ABC1FC44EE394611EEB31BE1C49FA21DCA1E9A9531F3E161F6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292017, "uuid": "c4977847-03ac-43f7-a268-58e509173715", "value": "1536:B//wqhbvHwMV2ncPwLcp+px4JTtXyHlrG076yMea+Zrnouy8HyMU:pI+bvHwMV2ncycp+YxtXyH1G07NBzouq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292017, "uuid": "66e78874-2cb5-41c0-ab5a-c8edb409d1de", "value": 65956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292017, "uuid": "c8d18db2-88e8-4166-afee-67d3c63ab2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292017, "uuid": "cffc3511-c789-423a-af39-615f24f3332f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b9a5b8-e755-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767301656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767301656, "uuid": "d86c86bc-551f-4fdf-a551-74f0d486b8d4", "comment": "Malware payload", "value": "1ca93d68e487ca6feb4295240a9e94d3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767301656, "uuid": "09811032-fdf2-4f83-8796-2b7d07900d19", "comment": "Malware payload", "value": "b26ef5aec6d4b598e12272b2c70a0dd54e6d2b5090978cded2d902217181fbfd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767301656, "uuid": "bb2cc9c2-142e-4c94-b580-5298c2681e22", "comment": "Malware payload", "value": "768f2f0fa5183fc065f02e7e33dda0319c2ea288", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767301656, "uuid": "2a822127-508e-48a6-aecb-6c11298caceb", "comment": "Malware payload", "value": "2b97aa64473ebd168777de6cd5d0739f3f6762e38b65851472da4dd07954edd0b3a12617b25692da1e1585fed8785fa7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767301656, "uuid": "373c14e8-0e55-419e-a1b5-12c8a864e73d", "value": "T1F9D4014773E831F8E0339679C8691A55E772B83147209BEF036446B66F232E09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767301656, "uuid": "6ccd86fb-28d2-415b-9ccf-355b52158972", "value": "f73c6a7c47053d807256877f079ae0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767301656, "uuid": "c52e34f7-0f71-420b-b691-71da13aaf7bf", "value": "12288:/IDEwe+QGBLWgYUrfX5cuz0A3Y5/SBCaPk5pUz4xv2dskBaG:JJ+QKYUrfXd0AoYBjPwGqwhoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767301656, "uuid": "eb8bbec2-5b99-4864-9d9e-2589924476b3", "value": 608406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767301656, "uuid": "6fcff05f-3d1b-4fe0-82c2-a3838be266ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767301656, "uuid": "299717f1-2312-456c-ae46-b4d17e195704", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f426bd64-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292231, "uuid": "d0eb7c22-a20a-45e6-abff-401f51de7347", "comment": "Malware payload (Mirai)", "value": "cafc83877cb9b827afed4dd4dfcddd1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292231, "uuid": "6b789089-31b4-4368-b865-cd455d641eba", "comment": "Malware payload (Mirai)", "value": "b32ed8402b59c12f1de60039b5604e932a0fbb4a5a4cb89058fd918d11ea2afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292231, "uuid": "217aab02-cb40-4135-9b55-84ff489ce52d", "comment": "Malware payload (Mirai)", "value": "4e6ae85b7cafee9e0b1b8763a82a2c3cd9ad3119", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292231, "uuid": "4b714eb2-ef05-4151-8799-c8807db7fa7d", "comment": "Malware payload (Mirai)", "value": "ace75f5071fc42fb028610496a002a4b78c34a91b6c79d7ac9749e8adef80f0be7f5b96981e44d61b4d51fae5be8795f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292231, "uuid": "3db0f645-c955-4fe3-8514-4bf030e28e29", "value": "T127142946ED418E11C4D622FAFAAF418833536BB9E2FA7102DE245F6023C699F0F77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292231, "uuid": "0b603068-199b-4279-ac04-2451d4abfe4a", "value": "3072:UfHxCkwnoOREHKVAbW58fyitIfKNwODuxEHK1gInWhszm/D2ldfl+caaNBpj7hto:UfRPwoOREHKVAbW58fyeIfKNwODuxEHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292231, "uuid": "92840db5-dbe0-4e93-9f70-3b9beafae5fe", "value": 195164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292231, "uuid": "bffb6831-32b2-411c-b145-7c7747462980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292231, "uuid": "2ebac8c6-75e8-4e99-ba5b-19bf74207e93", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30894ee-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233361, "uuid": "efb39aa1-a678-4d4f-9f20-af4bd5c9196e", "comment": "Malware payload (Mirai)", "value": "5a4a55e8c1ae902833be1a4d84361d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233361, "uuid": "b1a0de64-3e4e-4590-90c0-08b4a597ef3f", "comment": "Malware payload (Mirai)", "value": "b3a6de0df6cc2e35b99404a1f5947ea13d5624e833c54c5f46626be0c32cc01a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233361, "uuid": "c3a4f30b-8bfa-4156-a170-75753f4ff881", "comment": "Malware payload (Mirai)", "value": "2902364d8d908c07d5b0e58beb5ddc623719b7bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233361, "uuid": "11f5d2ad-60af-4194-b0c3-789ae2c4ee9b", "comment": "Malware payload (Mirai)", "value": "adf2a32a771bc1d65d3739f927fb092b660d17fa0763476d727c56bd068939d48d47415fd4c3221930c5edb0f183fc49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233361, "uuid": "444366b1-5d89-49dd-9f3a-bdee2a3684d3", "value": "T1DBF31B42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233361, "uuid": "a2f554f4-ef84-4292-97fd-9f8fa4cc1ea0", "value": "3072:nkGROPfU3yLPrW10QdY4uXfaNGwvO0JQByZFIVmP6hh1zvJ:n3RgfU3yLPrWquMXfaEwvTZFIVm+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233361, "uuid": "fc51e81b-8225-4eae-a73b-b221fb882071", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233361, "uuid": "a1d88df4-870d-4d5e-bcba-b6e2e3208c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233361, "uuid": "2ed42dcb-4c71-45bb-ab4c-f02627233479", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecdc3cd-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304570, "uuid": "e8385637-766b-4251-9dca-73bf5d692c55", "comment": "Malware payload", "value": "5c1e3805b440fe4b114da6f60c1ff5d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304570, "uuid": "6a2bc604-ef75-44cb-82b0-e36857cfa833", "comment": "Malware payload", "value": "b3eadaae58e6f843c78f7aeec2846512e22a3d3fa7b6141fa93b46562fc22569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304570, "uuid": "92ce9c65-7e25-45e4-a681-620d5ae02e06", "comment": "Malware payload", "value": "9265546476a49f93a14294254875ba0d13ea52a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304570, "uuid": "ff3650eb-a09a-4f25-bf38-f3bc2c2e6ba4", "comment": "Malware payload", "value": "7ee7dee841c7b42aeeba13c74ff9daa4562c0cb410fd0fc8df324535708bb2bf38c091dc2557402a34942878b8bedde1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304570, "uuid": "d9b3aed1-72a2-498c-98ed-239cc02f6a08", "value": "T1BF66F819ED843BA6C02D4B7590EECA5526B05D140BF14B3A26A4FBEDBC762347F0789C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304570, "uuid": "fbc9ce45-9f84-46cf-83ea-1b7ea9d8ec65", "value": "49152:sAiyArcYfZfBWLlQSi/3w0rFhyLIJtpyfR8Sl85Ey:8S3i/XtJ8ngEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304570, "uuid": "b84297af-2028-4cb0-a0cf-f62c81474193", "value": 6488279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304570, "uuid": "b24d9000-e49b-4fd3-8735-f30713158b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304570, "uuid": "f7602516-bf7b-44e4-95ed-e9d99bac8250", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89908115-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292911, "uuid": "e12b44a4-0fe6-4b86-aad5-5ca7751b95db", "comment": "Malware payload (Mirai)", "value": "f0836fa406e1f3174031aec9ff11e2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292911, "uuid": "1497db94-2e44-4998-9ddb-b6689c03f900", "comment": "Malware payload (Mirai)", "value": "b4279d8ad3ef3b9ac593ba149675ee10fb4a03fc609f43c5e3513e047b6d73be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292911, "uuid": "31684853-1d94-45b8-8516-c61c7b44bee2", "comment": "Malware payload (Mirai)", "value": "b57f00e01a7a9bdc4a1865b65f29e17808f40e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292911, "uuid": "5e44d1ce-1da5-44b8-a6a8-c05f38bd8f2b", "comment": "Malware payload (Mirai)", "value": "0b7b6a27c8437f8d141fa105d5ff2c5027dca7b458c4f8d79a9e3dd38605f2b66a1478fc9842249dfc9e7a849e1a3e97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292911, "uuid": "ce432b79-edc2-4f0d-be64-34ac5b700d2e", "value": "T10F7302B902502866C0774078BB6F1BD86F252FCE674B4E0A591FD393BE910BF26636D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292911, "uuid": "2cbc7395-9a13-426e-b05b-098b600d9098", "value": "1536:vapsbMFDbAjDGUGl4dxEsxbBtDCyYNsLdv8Wxeb9lv5zyOCT+VJuk:vapFVAjSUE4dm+72yghNtM+VQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292911, "uuid": "52fdc6f3-d114-4add-99f5-a7c4952683a6", "value": 78388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292911, "uuid": "8e5f06e4-ceef-45a5-9a84-1a7a735045be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292911, "uuid": "b6b40726-e1e7-498e-a7b0-8c788c06a754", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19898045-e716-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767274255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274255, "uuid": "e82f7085-9a96-4135-b50d-f87416fbc997", "comment": "Malware payload (Mirai)", "value": "d8c39899a65a5d158f5d13bd95aab1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274255, "uuid": "c34739a1-c681-4b10-bda6-5983d0af0ba6", "comment": "Malware payload (Mirai)", "value": "b455001ba98125c32906ebae57053f9b9c4f1d876a77b857d2bcb587c2faa2d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274255, "uuid": "77db24cf-6b7e-4d62-9678-133ad95f7e14", "comment": "Malware payload (Mirai)", "value": "b5e3ceb45a468437e8b66f329fc2cbcb83e339c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274255, "uuid": "93dd5c5e-f4d2-45cb-921b-c75b2f0e3adb", "comment": "Malware payload (Mirai)", "value": "4f59100adb793093a6da3fd5e37a257475147ba56f9a777ca4f78e99c5c5f3e1b398c1be52b6fa1d5d064824313d920e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274255, "uuid": "22fd4b49-b64a-449e-84f8-7a51b333d388", "value": "T17A342C46B9918F12C5C112BAFE6E418D33136BB8D2EE7102DD246F64378A8EF0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274255, "uuid": "0f461d54-e85a-4d23-ada5-38859102e6a5", "value": "6144:wWmV7StQ8gt0rGlMOqd/p0QmfYMqhzXGojacHrHe3He8KX:xmAHgt0rGlMOqd/pDKSBXPja0r+u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274255, "uuid": "dcff7d39-fec1-4342-893d-d5334a0594c1", "value": 237524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274255, "uuid": "db595242-2561-4956-9154-2aaab1a3d483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274255, "uuid": "3a6890b6-0302-4e91-8647-cd8f698638bf", "value": ".7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d05faa-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767279939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279939, "uuid": "fb372476-0441-4bb6-8d52-648534e4a0c8", "comment": "Malware payload (GCleaner)", "value": "20dd1e4a65b0c59069309907f5885174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279939, "uuid": "e4ff053f-2b7e-467d-b6d6-1c087487a295", "comment": "Malware payload (GCleaner)", "value": "b4a9ecec0b4aa7bca601c3714a85160baaebafc94d683784578e13c999ca046c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279939, "uuid": "3ebb26ee-d583-4362-9b99-b3755fd6285b", "comment": "Malware payload (GCleaner)", "value": "37368f1e35ff30ecb5f254fcff2f5f2aca540bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279939, "uuid": "2bad84b6-4598-4bf7-97b4-0676c0445b71", "comment": "Malware payload (GCleaner)", "value": "7e0e9192c6cedb9a697384697e634bd330215e1e165f8abe21a4b2862969d26a4fcb7f89d84ad33ef1e7a7b0bb495178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279939, "uuid": "9023c9ae-8a0c-49e2-a173-fed395b90228", "value": "T10806E1A1F107E331E02BE23B44D97D5CDB1DAB9664821FFD9A48DDC42E1E243B61AD81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279939, "uuid": "112c6091-c4d8-4b75-85f5-1fc2e5fdaf8c", "value": "98615183c8737b803f9ab650a6f91b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279939, "uuid": "457aa89f-edd2-4a95-a3a9-b5dbe2511ec0", "value": "98304:a4nCVK7P2oM3tYRriPSz/cTzkgL8UUFtGFlHkh53rvztVZTr8TpkDiVkq8:ZhO3YuSz/1Y2tGF9khxJL8TpkGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279939, "uuid": "a5618d95-8616-4ac8-9131-7b465add9d95", "value": 3981072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279939, "uuid": "d4852c30-8d77-43f9-8b21-10cd6816eab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279939, "uuid": "ab09f24b-0fa4-4b47-a4e2-6e2e93effc4b", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8fefe4-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272089, "uuid": "75ffc4ca-cca3-4f38-90e1-16dde7d0f889", "comment": "Malware payload (Mirai)", "value": "1b0c1fdc517c9b71d819bf2e42004140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272089, "uuid": "a4b58732-bba6-41b0-8d28-8b44a3b70239", "comment": "Malware payload (Mirai)", "value": "b60d082e3eb079c700cf3a2916189efdecb870f1993861651ec9dca005179e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272089, "uuid": "ca4a83db-b54d-4dd9-b192-513d3eead2a9", "comment": "Malware payload (Mirai)", "value": "3d16791c8ea3ae97befb23b13cca8507bf235a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272089, "uuid": "2010e97d-c96e-4db5-9c75-84255cc1db27", "comment": "Malware payload (Mirai)", "value": "e105a7507ed92aa2978454803b51b89aa8096bdf88bb073e7fa3eb5a595419abb8c8e14b0990e01ec7b19bf48ef80c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272089, "uuid": "96a4c49a-10b8-458e-af7a-6959fe66a32d", "value": "T19F83029065A05FEDEF22C174FFC390A66CE44678373AB26B8D458D09F5B60DCD603886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272089, "uuid": "04327146-1e67-4617-8cd6-d5ffadbaf65d", "value": "1536:2xCCZPn9VVZ/aGmtnX+SLozypxhegOk0AMAWB9aWo5vllFsf9QmEumS+3Tuuzs5f:8P9zZixFhck0AMn9Jo5vV5Au45TIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272089, "uuid": "2bf237ec-51c7-40bf-83c1-0ce7a006a562", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272089, "uuid": "14ab3601-8295-44e8-85ef-1baa1fc70a9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272089, "uuid": "0d97766a-1e3b-4fa0-b596-ed26e91784b5", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dad214e-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767279818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279818, "uuid": "010e4029-3f70-454c-b92e-6e579cc1e08e", "comment": "Malware payload (MaskGramStealer)", "value": "ec7928df1561afa4a9d8262b0c352563", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279818, "uuid": "3c2c429a-d593-478a-b14b-38d675cc3005", "comment": "Malware payload (MaskGramStealer)", "value": "b75e797806ec61d917482e27e31f63f14b3676460359b838287d167412f1cce0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279818, "uuid": "58aecff0-f24d-41d5-aff7-fbf427dd7473", "comment": "Malware payload (MaskGramStealer)", "value": "ae797f214bb33657f6b45c732f7b86e02d71725a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279818, "uuid": "fc3c8391-9051-4b64-9481-431896c7aceb", "comment": "Malware payload (MaskGramStealer)", "value": "d0c9f027d41c50fc4dddb2a0236bca4d127675d272530a03542ad4c00d6846fb96e98d0af40aac26f90d2601bf468dc6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279818, "uuid": "6bb37f3f-0911-43b4-88ab-3361040a9713", "value": "T1EEF533C906EC1367F4EFE6B066DA52055403F247BE26CE4CC3E85547267FA4E22B6863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279818, "uuid": "f9135ee8-c0f7-429b-9f33-5aeb9feb918e", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279818, "uuid": "f90bc0f2-6165-46b3-9dbd-5c46b83f456f", "value": "49152:ghs9JRu19aT1KV8qMmT5108jN9YDHEtOL7pyMFVDIHjauTGX/DbIDFZdyKQt9WM7:ghGJRDx88lmT5ZjN9YK04MFYNTGvNtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279818, "uuid": "206c421b-f9f8-4b7f-8ae4-70b34b765888", "value": 3422720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279818, "uuid": "bfb48e96-59a5-434b-beb7-bc693c53dc18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279818, "uuid": "589b2ceb-c2fc-4595-b1aa-2eedcc397c45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3720880-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767229389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229389, "uuid": "765ab044-2c4f-4f6d-9c30-12ed8635f964", "comment": "Malware payload", "value": "e56f6b9635ef3384f1d89f371a39a80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229389, "uuid": "df92927d-7973-4a1c-9830-7d6c3e822e4c", "comment": "Malware payload", "value": "b7d48580f00ffdf3f52f3f381c4ca8886317688c597031d0635045964c8ed26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229389, "uuid": "b23cc4b8-bad3-468b-aecc-b7d42f29aa5b", "comment": "Malware payload", "value": "7a715fdad2759182ef16a34e55311f379ce79574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229389, "uuid": "48616b07-7765-4e37-802b-066089650839", "comment": "Malware payload", "value": "f6aadfa7bfc60d4d64db62a41267837357e2220ff3e8fe7394beaceaf817c66ff1ac803d7fe7b685ae66aa5229b88a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229389, "uuid": "5bc00b4c-c972-48ba-b5f5-660704d0866e", "value": "T1E7086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229389, "uuid": "de7e4e1f-0788-4b81-92dc-9a7063bb327b", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229389, "uuid": "54f297c0-950a-4307-b04b-9bc349dcfdba", "value": "393216:Ls/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S++:LEYGD7sJYgNukUB4S5rs3wbpLLNNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229389, "uuid": "2692e3b9-6c78-4926-bd6d-00d5b7d2e3e6", "value": 82082565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229389, "uuid": "16d92e22-bee7-4927-a897-75ae198c5071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229389, "uuid": "ef44d348-65db-4cb2-ad58-47e602ecaec4", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff715b4-e72c-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767283902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283902, "uuid": "8700d5da-63e0-4525-87ef-503e29cbb67f", "comment": "Malware payload (MaskGramStealer)", "value": "713f9fc1b7e9b4c5791f1c21715c32a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283902, "uuid": "fbad7164-90cb-44a2-bdcd-6fd95d60f0dc", "comment": "Malware payload (MaskGramStealer)", "value": "b84131383ad62bf433a814607c07f47df9c29adadf35647c5958b824a9ebd6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283902, "uuid": "1113e51b-428f-4233-9857-e7dd0add6234", "comment": "Malware payload (MaskGramStealer)", "value": "01f21df32a5e77e1049122d4115566d9b7b99a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283902, "uuid": "8ce02c05-fb6d-451a-8892-a02f2bfc3ae3", "comment": "Malware payload (MaskGramStealer)", "value": "e4d3e3556974d01f3b8b94ed15e9d794bf82a7ec628984e268321f0e533d15b80de5636a339991d4be5dbc4d815738d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283902, "uuid": "a31b1794-aa94-45a2-b9a9-e563dd79cdc1", "value": "T147549EDF15F7B68DF4F8BC70A0512E94F491AE2DAD1A95F0C07AB0B037365C8294E866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283902, "uuid": "ffcfff16-0da4-4ab1-bbf8-604fb02eb370", "value": "889d7d9bd78af47c7881d69d79690e91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283902, "uuid": "aae44162-09c8-4cf3-9ad7-98cdb6cf68f9", "value": "6144:JWcKlg3P+cCLf7DNWC2UnIvrPO+XaNILtL6iZDC6IEHL6VkiS:JW1lgizFqjFXaktL6ycabiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283902, "uuid": "342cd6e2-d202-450c-827a-5cf9af528b43", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283902, "uuid": "a0cb1afe-3cd0-4f26-831a-af98cd2f0e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283902, "uuid": "11e80861-4d09-425f-8cca-8ce50dc2cdab", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d920919c-e729-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1767282737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282737, "uuid": "c37af292-8161-472a-a2f2-608fef522d33", "comment": "Malware payload (MaskGramStealer)", "value": "5a2edb6d68d47a0d4baaa0143d402527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282737, "uuid": "fdfaf291-4bfa-4c1c-8fcc-f1e640967c97", "comment": "Malware payload (MaskGramStealer)", "value": "b847c47d4a5924064755207423d38c13658b43d4c395cdd2f63e7079520541be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282737, "uuid": "bc24c46a-520f-4818-b2a1-8098f892061b", "comment": "Malware payload (MaskGramStealer)", "value": "fa39aa7555dd9abcae545f2e3f2df24d9f5f8a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282737, "uuid": "ea6156c1-4d0f-4858-8c82-5f739509327d", "comment": "Malware payload (MaskGramStealer)", "value": "32592a540aadd383a787a94e61f9af47fec33192e3f6db92c1e871706c7cb17dbdd54572e43d0392649c20251d74207d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282737, "uuid": "da9ed748-ee9c-4b61-a383-e7af99254428", "value": "T113C63358A26044DDF9E3E23B994150E2B3F2B4241B71CADF07A856993F57BF24D3CA48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282737, "uuid": "f3a3ab01-c7a1-4d7d-b027-ede2be60b869", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282737, "uuid": "94af0dc7-b5d2-4789-8be0-11d480993e20", "value": "196608:AqhWeagTSJIeRo+jFgaIAjNyMzEltbW897GGr1LDsBTG9WdSWQta/R6:Au+uSfdjcMo1N3sB1sWQ4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282737, "uuid": "3c157919-f6ca-4dd8-aaa9-bc7c166d719c", "value": 12100524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282737, "uuid": "88e2bae1-c886-43e9-9314-d51b53a43e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282737, "uuid": "a244b53d-5251-472f-af5a-d0d0692e7d06", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2f1cd5-e747-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295440, "uuid": "adb148dd-d45b-4384-9c6c-c7fb8105921d", "comment": "Malware payload", "value": "5272b08ac59bde3f6fd86645a7eb33e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295440, "uuid": "cbda5733-930d-4bcf-a8dd-edc3ae67ce8e", "comment": "Malware payload", "value": "b8b6d088c602122bc6c17ad679adf120d75afcd288406bbad1ea6392e021498e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295440, "uuid": "87b69571-4c2c-4d24-b532-750bc3a9903f", "comment": "Malware payload", "value": "b16825132b5ccce0a0d2837a0ad12ad0befca986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295440, "uuid": "d5e97d8c-4138-42b9-a2e7-6670faf92e99", "comment": "Malware payload", "value": "7c6d508c2b8648383bae39e1027d51f99aa2d611e166c0a68c0c4ccd2c5b16605e4707d2f7d8a21a3226d35ce065b404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295440, "uuid": "d05c9397-3df9-4345-9333-a7865fb04f6c", "value": "T12D733B81F58BC4F5D81749748167B37FCB32E5298031C5AEEFA9AE36DE236429213358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295440, "uuid": "e9d889c9-db75-42de-aefc-ec0c5404e352", "value": "1536:/34w6Ih/eI7CxPmiidYsgaOw3ulBWZqWKmWbT52YWIK29E+93:/34w5h/F7FiidYsROOu2IWKmWbt2ZIi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295440, "uuid": "f87accf8-d0a9-4496-a122-5154e573106a", "value": 75860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295440, "uuid": "86cf24aa-4bc9-4ce5-ba3d-2350401ebb6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295440, "uuid": "c4989312-2986-4374-b5f2-b22c6bf942a9", "value": "goon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e2e011-e726-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767281225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281225, "uuid": "8f9b9c08-0c03-48c1-8565-27b6cb61597c", "comment": "Malware payload (GCleaner)", "value": "3431ecccb15e6abcfd096d36b7ac66f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281225, "uuid": "fd49f54b-3b7d-4952-825a-b60068495907", "comment": "Malware payload (GCleaner)", "value": "b9db2fbb4b7c0937842256ab393f07648bfe99a05c1de7ffc6e7b04b13696bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281225, "uuid": "34e0369d-e13e-42d8-a5f5-2edc3d170a8a", "comment": "Malware payload (GCleaner)", "value": "3bb55f1d5abaa587a718aae577fa8876fd33cbed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281225, "uuid": "0c45b330-24d7-4104-a236-b69dde16f0ef", "comment": "Malware payload (GCleaner)", "value": "e59a804d40de9ab29c266a8e80369edd49f6ae938791586d46c8b4ef8c21afad87d524fc83b79f989ddf90d75818cbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281225, "uuid": "51cd2175-7359-49a0-be56-786cd020a5a4", "value": "T1FB06E1D171F8587AF16B12350B35925C6CF93FF218E873960FAE3C593E9A2B12A44523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281225, "uuid": "a95ea92c-a619-490c-86bb-18daaf384310", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281225, "uuid": "c35074d6-ec38-48a2-bd3e-120c92303bd5", "value": "49152:erPiYStMTWyG7LpurVZgcBnXf7b4YmqXAkrG3r7E+K84R5a75879NyHbcOHNR:erd7WyGpurVPRTXG3rofx3OtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281225, "uuid": "395bd250-5d26-4124-823f-8c3fd4225e59", "value": 3683088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281225, "uuid": "4c92b184-6983-4050-a374-b6e710cd9dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281225, "uuid": "ab766979-ee07-4d03-99c1-d3a5fe54851d", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e3c584-e745-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294539, "uuid": "2b6981ca-4628-4d2a-a178-2e583b6063cd", "comment": "Malware payload (Mirai)", "value": "1492cb8cf552bfc106512ae792cedaff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294539, "uuid": "0a047efc-6a1b-44a4-a117-324bd9043035", "comment": "Malware payload (Mirai)", "value": "ba4c52f70900442941b2840d2490449ce44e3bdc3985fc0eff94a90ef6362335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294539, "uuid": "fe1a7873-3ef9-4f11-856f-0d001e6181d4", "comment": "Malware payload (Mirai)", "value": "58c43e4eb932a8ae61e837ad4ca7c71d80a5cf6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294539, "uuid": "8bb0e87a-853c-47b6-b2b1-47f44900d25c", "comment": "Malware payload (Mirai)", "value": "8897092a576d21a162b55991357418ad7505fc49e2937f9d967c82b063cbfdb990543e1a3e7f924c98075da256b0c913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294539, "uuid": "2b6621a3-ec27-4cd4-a6a0-38c418411226", "value": "T1A6A34B52FD92DA12C6C162B7FB1E424C372743ECD2EB33039E256F21728A91A0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294539, "uuid": "204228fe-7771-42dc-a09f-087ea7c3b3ce", "value": "1536:fnvDNgSBqIQccqpz/rTS2F4DSMHv+i7Nsd0OfQxW/X/Op2GfIsMY+og8EM4w:fnvDNgORhz/HS7lHz76S+QxiW9+Pcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294539, "uuid": "cc71e6c2-c0dd-49e9-aef8-72199fe390d0", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294539, "uuid": "31e76c89-f057-4c6a-ad9f-5e440fc49678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294539, "uuid": "2629b414-4402-4a1d-96af-aac47277b812", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10ccf4e-e74f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767299017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299017, "uuid": "aadf0e7b-a3ce-4030-8eff-78b711f084a3", "comment": "Malware payload (Mirai)", "value": "2abf0d86a99eefd4014c55b7607044b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299017, "uuid": "55246e2e-50c2-4bdf-81a9-cb75d72aae80", "comment": "Malware payload (Mirai)", "value": "ba70281b45e43d9145537f8f608809260ac41730d89da9ba6630b65f45eba103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299017, "uuid": "0a293bcd-39cb-4bfe-9879-64df8f1fc3df", "comment": "Malware payload (Mirai)", "value": "50de96e46c392f1b4fda208e37a9b5ac65b58228", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299017, "uuid": "d3d39678-7aa0-469b-9b1c-d920038546d3", "comment": "Malware payload (Mirai)", "value": "8f855778859c48a18ac1a81d267bf0f7d4098b8a267b1249d19cd48d50fc4488626f0bf404204efc421dd4829ce31d8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299017, "uuid": "172f49bc-d257-41f6-94a4-51fd54107e0d", "value": "T1BDB3F855BD829A12C6C656BBFA0E828D331723ACD3EE3213DE145F2136C791B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299017, "uuid": "8b33f017-d7ae-4206-ba7e-936226a678a1", "value": "3072:yBvDE0d4xP8uy59m1dFZl9UQY8zRjWSrfyNv/TJUFkj3IZq6BywF:Y7E0d4xP8x59mRZlKFkjWSmNvLt0ZqaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767299017, "uuid": "f3d0df80-0375-4b4b-a3b5-b118bbccd98a", "value": 108908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767299017, "uuid": "ac77ac6b-eb3f-4a16-b01a-2fa6d1f61483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299017, "uuid": "300bad09-abfc-42a6-83d5-70e75ae5ffe0", "value": "SecuriteInfo.com.Linux.Mirai.9829.23286.15928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8f88b5-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270664, "uuid": "3bc66d53-9a61-4366-85d3-27d7a4852319", "comment": "Malware payload (Mirai)", "value": "24b57d46421200e0880dc3e13722ca1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270664, "uuid": "93372b89-06e5-44a6-a9e5-7967c10ee60b", "comment": "Malware payload (Mirai)", "value": "ba78fa609b2cb88eb1e547633e4f60630a6a3219649e90e7344e1a35963a6fe2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270664, "uuid": "453de5db-0ac5-48d6-8f74-ff757985dbd6", "comment": "Malware payload (Mirai)", "value": "db43973cc23d16538106861055c8b77d624c6fa9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270664, "uuid": "68a10c1e-2fb4-400f-920d-fd78a3f4cc7d", "comment": "Malware payload (Mirai)", "value": "aae58644b6d8ce9142007238a3d388e78dd0a244847062c0dc37d3035982db699c0c4c5c58d11dfcc53c0a7f6f892fa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270664, "uuid": "565eaab7-43c6-45c1-9e29-5ff0ab6f48e5", "value": "T19E3152C4124143B96CA9DA967BB94618B195B85A6CF0FF68F8F83CBCC84CF4C3055657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270664, "uuid": "076e91f1-cedf-43e9-b9c0-689a012c67e1", "value": "12:q0FRZvW4a0FRwvp20FRoiv7u0FRIexvIed75a0FRQLvsp0FROivva0FRkvx3+0F2:va6sjW+rCl675fkw4emFUifOpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270664, "uuid": "3231f790-41fa-47f5-a9dd-d6997b836753", "value": 1763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270664, "uuid": "7baf533e-9f67-445f-9f5d-47f20aa2a34b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270664, "uuid": "0ff9eec6-cbd9-4d22-ae72-0b86979bdb98", "value": "jewn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7da334-e75b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304160, "uuid": "0f6f6c1a-8c3b-40e0-b343-bfdb85956f17", "comment": "Malware payload", "value": "48c1f60a9115e29075512e0a7de33f03", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304160, "uuid": "94f0782c-85b4-49d9-ab11-78d8a6ca3b9f", "comment": "Malware payload", "value": "bb72f69621da585bdb03ab364b2cdcb572221b4f683ead179c1ca6c453ddb40f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304160, "uuid": "9236b5ad-0284-401f-82f4-b51cde105523", "comment": "Malware payload", "value": "a74331b38c64d7b46deb61a7d3b16636a35ce50f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304160, "uuid": "b8c4a060-57e0-4b86-b7f9-1d5eed5d62c5", "comment": "Malware payload", "value": "5eeece72284f94ab7319fc442a9b56bfe4ee1021da38c588c9aa9f639827c3132d36e76dda0a53856da76e034a103376", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304160, "uuid": "ab94761b-7fcc-4fa7-9f95-71e88db7efd3", "value": "T193A124D099D81788F27B0833FC7E72450965B36D8B2B425A65DCC30592E1A2DCAAFF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304160, "uuid": "b423db84-bb06-4101-87c7-4144cd248692", "value": "96:8iJFpOMno9wCtGgtgGsZXqpetn8H+m5KhRjY+WtCxu9izWCDm95UXtHQifMEz+tq:8iJFQkoyotWXqpetn8H+m5KhRk+WtIu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304160, "uuid": "6c5fbfaa-c316-42f8-b563-263f9a6b533d", "value": 5041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304160, "uuid": "afd7d85f-42b2-49bd-87cc-ec36c5794360", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304160, "uuid": "ed97100b-c830-41ea-be8f-fed9e82e9534", "value": "Offerta_G_Napolitano_24-12-25.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79f1853-e768-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767309766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767309766, "uuid": "e036f889-4619-434a-b285-43499bca8538", "comment": "Malware payload", "value": "9f9a43a6d90f2836908c17b69e0940fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767309766, "uuid": "e4ed6946-8a1f-4b4e-b077-797c1a0fa66e", "comment": "Malware payload", "value": "bb83eb10f54f2a27d33b115caf19eb9a149387cda766e6b78c725167429c70bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767309766, "uuid": "3c2b53d5-4bc7-4213-9422-25929089ef91", "comment": "Malware payload", "value": "3755d968e80d03b1c27cb48ca43488ca4f07c770", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767309766, "uuid": "b721c586-235d-4fbe-956a-0c21bcaf8414", "comment": "Malware payload", "value": "07ffb61608d9658fadbd6e9572459b530ad453291819547a2929d75b8f99b660fdb5f0e423e0d20f65086b68034892a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767309766, "uuid": "539d43af-e7b6-46f8-b8b1-1a905fba83e6", "value": "T1F23502577BA9F1E9D1378278C4820B16A7B2B4324B205FDB0785836EDE532E08D7E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767309766, "uuid": "02fe30df-7b40-4379-a61b-59501c9a597a", "value": "e10c12367452babfd86e8488cf3f18c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767309766, "uuid": "5dce89b4-ae00-47ab-9157-3bc7e5b5ddbb", "value": "12288:HAuosfiz/Wgnmzgx+bNz1t+mgGOPjtF5o3SqGMimv3M7bkiFkAfr:ghye2t+mG5CGLmPM7bkiaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767309766, "uuid": "6da12d07-847c-40eb-9dc1-3b30049258e2", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767309766, "uuid": "4dc2e369-64d5-49f7-9109-48c87d3dc211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767309766, "uuid": "76446859-e37b-4571-8ec1-fcc9d1aecc50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a378934-e6ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767228863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228863, "uuid": "0006f7a9-69ef-4b23-bfb9-2f53d029488e", "comment": "Malware payload (Gafgyt)", "value": "048352fe6eb9ca9f922da3c642a6b58b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228863, "uuid": "bb801ffe-608b-4f6f-9312-113068dd3d3d", "comment": "Malware payload (Gafgyt)", "value": "bc138e16b715fca267e582d0088df28e53f33fec4ea9ff655ca09a5615b6b7fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228863, "uuid": "1cd3a181-109d-4068-bd26-46ddbd951a07", "comment": "Malware payload (Gafgyt)", "value": "47df39f0e5afbef2dc641eedee0bc2c099b2cf40", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228863, "uuid": "815b555c-2ee3-4c51-a952-8fe87c09e7a1", "comment": "Malware payload (Gafgyt)", "value": "a0181f5203785565a88823a888aa59c5d41ae44ab0ae8cd1fae2951ae8a7c415c1deec87b4baf543197eae0bb8dd939c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228863, "uuid": "ee2f677a-daf9-4cd0-b826-a89f64dade11", "value": "T174115BCD2354D257DE0CDF4C7F9DA22CE654A7D4E5B08B20E8E5893C9A9C2093067F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228863, "uuid": "f5bba377-4475-41a1-8165-75b3eef7b93d", "value": "24:3J3GObkjIXlxNI5nI1rKDPUpCd+nfspCBCqCtuk2cx6yvYPTMuHA:4ekolAIxyPkCMnfMCIqCQk2u66goug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228863, "uuid": "0768e1fe-9ea7-4701-9ccd-c5fc3b5c9e6b", "value": 1044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228863, "uuid": "765614d6-6df2-47ea-b3be-1c198228eb3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228863, "uuid": "3963be30-e5c5-4d01-88b8-4bd735c66f38", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5888bffb-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226257, "uuid": "7588fbc1-134d-4967-ad6b-f2e20b7292ea", "comment": "Malware payload (Mirai)", "value": "b2c7ae752eff1d5215ab9bb43dbd87b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226257, "uuid": "074afb40-a4e2-40e5-a247-745fb177c0f7", "comment": "Malware payload (Mirai)", "value": "bc28983d44c91d3062f924f80cc99045d127cc9967125aa8be5c85dde32edafa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226257, "uuid": "32b3151a-997e-4d9f-af21-52846a13ed9e", "comment": "Malware payload (Mirai)", "value": "b717cab822c51d5f8d83c0392c076215d1c9b046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226257, "uuid": "3e7cb6db-e258-4d7b-bb01-f435c1bb91bf", "comment": "Malware payload (Mirai)", "value": "935d5949f7a52e12d9ce72d19d0794b5a18df2154f913038eb69dfb2f6bd744040880977e1852f2ac661d86bb571c930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226257, "uuid": "e0a81025-5c23-4dae-b860-e3d6800f5431", "value": "T1AD235D43711C0A6BC4A65BB4293F1AE083FFBAA121E4F6C5600F9B5A8575E371086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226257, "uuid": "fc5195de-18dc-4dd4-b4ec-0bd1ccc44457", "value": "768:jlENRtPlsedRtQUsljdxQEN9u1F/O3ZWLN90BOHSnJRt/ut:uNztp4lxlNtJa3HSnrFut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226257, "uuid": "3dc8a0a1-4cf0-4f4c-9b33-2d6daa333d32", "value": 46912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226257, "uuid": "47b965d2-d1b9-447b-9bf0-6bc57a6fd9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226257, "uuid": "7dc486db-8394-4251-ad07-d74dcfeb1e31", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce62333-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227553, "uuid": "e4deb8e6-5a83-4735-943b-a3275be4c5c9", "comment": "Malware payload (Mirai)", "value": "62a697a7bec09c6c88710b5acd1801e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227553, "uuid": "75d4e516-82ce-4ddf-9e00-7d57a8ab6605", "comment": "Malware payload (Mirai)", "value": "bc573463da08763ae3f2bbb788f112e8dce26e30520918a1b89f3c19d2fee04b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227553, "uuid": "cb77804e-a023-4b66-a4d9-0355c33fbeb1", "comment": "Malware payload (Mirai)", "value": "b848fee51c93dfc731f4c30f9f36bde24fda87bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227553, "uuid": "7e4b1635-b52a-4fd8-af10-1574c7d5520a", "comment": "Malware payload (Mirai)", "value": "0bc760d366c923f2a96256dfa1f0090ce7d7b0e65859f7d6b49be76175cde43cfe508a6b594340a8d1c4920b59764449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227553, "uuid": "4da5d4c1-da87-45a8-9326-04d4754869b8", "value": "T1B9E328D7F801DDF9F80AE33748574905B530BB9248525A33326738BBED3A1A91573E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227553, "uuid": "3b68ed93-8b1b-4c18-b16b-fbb54c4bad2a", "value": "3072:XqvDvle7Puk68cw623BFgBHQV6BKyVGjbimLJ6Vay5lON6:XqvDvA1623BsHHBKPLNy5sN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227553, "uuid": "9d816e90-0d8e-4a48-a1e2-b0946d4afefc", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227553, "uuid": "48e91836-818a-4ab6-bc81-59fb08a7e06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227553, "uuid": "eaeb64c9-3c08-43dd-b7b9-b0b787078179", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc1409c-e715-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767274074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274074, "uuid": "eb196226-0ff2-4e03-ab88-5c3b4580d970", "comment": "Malware payload (Mirai)", "value": "63e8f8756a4d260d2af6b3c87e46c293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274074, "uuid": "7e9ed18e-c4fb-4e6c-a403-948437126536", "comment": "Malware payload (Mirai)", "value": "bd214eb0c453b8132dd4a901ea5bccbe939f25f6fcdba7ddde9149a2721385db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274074, "uuid": "755b9a22-9efa-4d49-aa92-2700914e4655", "comment": "Malware payload (Mirai)", "value": "67ddad8fa540c9820b12f4a4f9317337b2049424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274074, "uuid": "51aaf0a1-49df-4c9d-9452-44ae9e0ea25c", "comment": "Malware payload (Mirai)", "value": "3195e82afb1b2378254d0f7221cbeaafbbbefd761373be810f403c1c05e8eb72305dd064eea202f5a79aade6d8863633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274074, "uuid": "33d5140d-6917-4c19-a05a-99d5b3c6cdb6", "value": "T1487329D6F400DDBEF80EE73B84170506B231E7A60F920B762357796BAC750A5193BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274074, "uuid": "c84d917c-aaec-4a3d-96e8-6ba2a2faf5d5", "value": "1536:iJhZoAUvZWlQKp1mwjNsy0ynxJXjFaQSr8zty+aDy/gCDLcA/YlQwgdePNxI:wA5h4HvFj3PPXjFaQSQy+aDLQcsYC8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274074, "uuid": "c26449ed-1793-46f4-80fe-26a2814f4257", "value": 73584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274074, "uuid": "6d38e920-9299-466a-b230-100dab30aa97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274074, "uuid": "5798ba0f-dbf6-42d9-8c65-ec13be1298c9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c594632c-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767283133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283133, "uuid": "a7d7f478-8093-4a98-9a64-5161778ce1a3", "comment": "Malware payload (Stealc)", "value": "4ebd917ee47d121df0ce6621fdaab5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283133, "uuid": "7e12a5d9-0b97-4749-89a7-1b00cd511ebc", "comment": "Malware payload (Stealc)", "value": "bd8c11720b38730d252793461a7a1b26827ae459bf26752a0fcd5e0129fe4ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283133, "uuid": "9aaf8c91-4805-420f-b419-147b45ed19e5", "comment": "Malware payload (Stealc)", "value": "611dce41b620eafd4ca8e10ec62c0513d73c1548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283133, "uuid": "42797a49-def4-4513-8107-e5eb81c08489", "comment": "Malware payload (Stealc)", "value": "46a8406860badec483f0bc4edd14aeb00110c4f02e3877b68b62fe34d5ae130296427fa007475bd9437a0371af4cdad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283133, "uuid": "71f78656-c39f-4ae8-bcfc-0d77d205aad6", "value": "T1FDC578F0AD01D4C1F57E5B7BF3ED7908A1343227EADD5A4A00A466592EF6A01F90ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283133, "uuid": "b6458db3-e549-4575-a555-9de39a5d3237", "value": "66506cf48bfc3b0d79a8e3790223e69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283133, "uuid": "8cd64a71-c31a-4463-bdfd-163764790dc8", "value": "24576:oIZykdQNqiRbne08iaDv3gyd99MpwSU9ERHa:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283133, "uuid": "af7b199f-d25b-42e1-9ef7-760d14cc2dfc", "value": 2583040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283133, "uuid": "33014b15-36c0-4036-93ac-8daa04c8d9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283133, "uuid": "c2021d33-6c5e-4db1-8bfa-d06867670a6b", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befa7d0f-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233301, "uuid": "68006cee-1b0b-490e-946a-abc12bc06cf7", "comment": "Malware payload (Mirai)", "value": "1c880c0de68c215d8eeb23c35c7ffdc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233301, "uuid": "bc18cb4e-0ca0-4486-a74c-9e837bc2f439", "comment": "Malware payload (Mirai)", "value": "bdec7b11fd9902484dcf930927ed843d607c4e0678e42f5f24758d946dd66f7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233301, "uuid": "9609bc0d-959a-45e4-89d6-6cc20c07b7fc", "comment": "Malware payload (Mirai)", "value": "d2dc65d216d9c18fe5872ee1be1bb0180f0dcb09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233301, "uuid": "27e0f51a-6a67-4352-964b-29d3c3ae32dd", "comment": "Malware payload (Mirai)", "value": "59ac54b305705c0590eed626f84ca2b550e0d0ddcfd3670f26dbf95580cdf82fa16627a0e28cb804fb08af2416fd2d50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233301, "uuid": "2c48fd9d-6326-4a60-a23a-2a19a4431427", "value": "T1E343F120FE905ED7CCAA8C7480EE35755F5D612832EF87AD67270AC4B31920F746832A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233301, "uuid": "23ad332b-c326-4f1f-b5e7-c7cda2654edd", "value": "1536:tIrRD0gn1aEVi15uooQJpP8LIYUK5xUSteRA:OdUEiOdWF8KK3CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233301, "uuid": "07090260-279c-4715-a88f-f5ec2fda1de3", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233301, "uuid": "cf47a16d-2da7-4505-b7be-f569de2af1bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233301, "uuid": "be57829d-60f3-400c-bd8d-c3c61df169ec", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3cdab4-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272090, "uuid": "7796e593-1979-4f3f-93d5-1e1df996b666", "comment": "Malware payload (Mirai)", "value": "329056177876d2cb0fb7e23b43fcb8d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272090, "uuid": "77c141b6-5825-4d6f-8549-b5e3274f4724", "comment": "Malware payload (Mirai)", "value": "bdfd1cac3478077880e55a4914f41d3440554585a7abe27389ec7dc801cbda4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272090, "uuid": "8a7713ca-8c53-4e1f-ad49-392c802aec5d", "comment": "Malware payload (Mirai)", "value": "1a596e5e8468bca8378d68724d0135e793862ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272090, "uuid": "d5666572-ba07-44ae-b7bb-83256593c587", "comment": "Malware payload (Mirai)", "value": "51c2f999b64332e992e9607e3f622185df28ad46a90023e23a54c86c55e0ff53b926bd16f33dfa73d2fec5c6bc9cf4af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272090, "uuid": "02b31b0b-b135-4595-9e89-e999cf44c4bb", "value": "T13B9302667D8D9495E5EA93732CCEC1792E678D8DA173700DDECB078164E70AC139CE22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272090, "uuid": "510f7c7d-6de3-4f5e-aa78-eb19acf3cf6a", "value": "1536:bKg390A9biXsW0qhfQds3r3gG47zSVH5fobct9oc+UteuEgOm2v71G5wCyU:bKg3RbiXsoQs3r3gpzC5fowtHJEgY7Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272090, "uuid": "38110d8d-d218-499a-9a56-b478ff90b560", "value": 91832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272090, "uuid": "3d78ab36-b2a7-46d8-ab90-034326035548", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272090, "uuid": "adaa72c9-7295-4793-8506-510a2f2d7c9c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9322d5-e6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767234506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234506, "uuid": "dcbb9471-3572-4bcf-9905-a31cf366c1d3", "comment": "Malware payload", "value": "eaa23ec8325c83f0d94c0334ba31ea3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234506, "uuid": "18068942-72dd-479c-8f5d-4abcb63217c7", "comment": "Malware payload", "value": "be76dc2957f62689ca1a74ba99b568fef7eac416cc3c9abba90d64714e91338f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234506, "uuid": "d0fa6ab6-2d77-4a55-96bf-f959154d56ca", "comment": "Malware payload", "value": "ebc5e6bebde49404617fa5ef46415e4ac6e78eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767234506, "uuid": "c9b41483-87db-4103-be4d-9c04c1d81f0d", "comment": "Malware payload", "value": "21061940701be0ca321ef289874223e34e2ca466660dec4b3bd94c7c1e3ba23a2c84157a557097da2d42129d76e67c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234506, "uuid": "5707a08d-73c2-49e7-b477-40c1f6b87af4", "value": "T1C5C42340D690D46AD0B3C774957FE1E31DD8AE81C654FB0B97CEBFA572320D4A89CA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234506, "uuid": "3e1a4bdb-fce0-42f8-9fab-fce101add7e6", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234506, "uuid": "afc258a9-8aa4-49b3-9d21-a5ef64d44bc4", "value": "12288:dX4eKbrJnAr116ryxFWAkgVMdYze9HK6f5mAWnNNk8GrXw:l4eKfxDyjg9H9mA2Nkdrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767234506, "uuid": "bd021fed-ab3b-4828-b035-a09fa7e658a4", "value": 544320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767234506, "uuid": "2d67c2b1-f0ba-4c11-843d-463d1ac8d456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767234506, "uuid": "6db9b961-3ae3-4f82-a9e0-762fcc0fe34a", "value": "SecuriteInfo.com.FileRepMalware.28159597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ccf961-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304578, "uuid": "801be34a-79ef-43b0-ae28-46944c790af5", "comment": "Malware payload", "value": "56e4838e5d8b248add56fa7a7b5c49ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304578, "uuid": "f9c2066f-0c86-4119-9a07-9d261502160b", "comment": "Malware payload", "value": "beb8cbd6be2c822688fe3f7835660fda7731c302e51b8745d413b693a50d1681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304578, "uuid": "3963d3e0-116f-4051-b555-0991dd8100f4", "comment": "Malware payload", "value": "afc41367b4a7c93e4baf188dc881119bf1a55c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304578, "uuid": "a54229a4-3692-4491-8dde-824bee311067", "comment": "Malware payload", "value": "3bd3a6737336149d2bb6679a324b0c8c03a1fdd9581b922e0279a27a4da025408d71c5078f726cc1a4ebb4942a8c6926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304578, "uuid": "c3838b7e-44a0-4e12-8123-25b2e6a02ba3", "value": "T1EE6639137B6CEB0EC22822305DB1CA8467A91C4986D79517B391F31DE9F20AC9D6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304578, "uuid": "8cf6bd24-64e7-435a-bc6c-deb18e367de7", "value": "49152:lWOp9somd9pDhmtKqM//EjS4aZspVaC6eomJS9OZTOdSUHfmRHHEt5Er:X3jFT0OChf8nEjEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304578, "uuid": "3c6007fa-554b-4f8c-88d9-573fcf99fcc4", "value": 6488279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304578, "uuid": "86299a42-92af-45f0-a966-ca19a8edfed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304578, "uuid": "db8adb12-5cd4-434f-80a5-914368ead973", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9756cb42-e6e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767255138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255138, "uuid": "eea622ae-dce5-49b9-a246-a3cd5688e31c", "comment": "Malware payload (Mirai)", "value": "ff81578352703f41e8cc8aada3bc5032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255138, "uuid": "18a57dff-8a55-4bca-aa7a-184bdeef7537", "comment": "Malware payload (Mirai)", "value": "bef0387dc9ee9c626713307afe38bad0703382461a65f9503670fcc2d470fdcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255138, "uuid": "ca66ba02-bc75-4c6d-b9ee-44d82b54a2e2", "comment": "Malware payload (Mirai)", "value": "8e238ae9c97cfb128aa589ec5976e5b7de39b63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767255138, "uuid": "b2f223b1-973c-45f5-8a04-c850887767ca", "comment": "Malware payload (Mirai)", "value": "b3848da4afa8e9aea465d1b0920b1af3b4b3921f92fbed77a559a8dbbfc7d42538acfc77b2cb01bc8a7d2441f0b9ac59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255138, "uuid": "6349f5c2-0bd7-420b-8c01-13ccbe0068db", "value": "T10593C91E6E218FADF368873047B78E21979833D627E1D685E19CD6006F6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255138, "uuid": "cc4543ca-a4cc-4162-a78d-a07b22638770", "value": "1536:neOoQeT1u9K2ktCLUw+IdnGjqAaS3QLymw7A51Xl1BezQZeaPY:neOoQeT1u9K2lUw+CnGjqAaS3Dmw7w1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767255138, "uuid": "fd391f4a-934d-4989-a3fe-b0ceb16c7bfc", "value": 97368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767255138, "uuid": "46fbbcb7-0cca-4362-8ca9-0046c01d520e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767255138, "uuid": "24c8f2ff-1162-43ba-a1fa-0999750c2d3e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319e9b82-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272148, "uuid": "bd3b956c-1b17-4931-873d-7cd301d6d776", "comment": "Malware payload (Mirai)", "value": "93c7f7759ab5732d60aeacf8be785df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272148, "uuid": "884361cb-07e2-41f4-8682-fcb8a95c6a6d", "comment": "Malware payload (Mirai)", "value": "bf10452ec245f32107fea4d459d4f45e5b466a0deb28c2eba81855624ad3ff89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272148, "uuid": "d5f9a2c4-1385-46d3-8b88-17b0d9f016a5", "comment": "Malware payload (Mirai)", "value": "f2ea6823072af6f79659178fa0687a4baf6a783d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272148, "uuid": "bf79b72d-b57d-4fc5-aefc-67d0f5723454", "comment": "Malware payload (Mirai)", "value": "b70aec2c9ea037321b208c336a43bb637584b023dc18eda27c9b6dcb3cc0466c5eb9a8f1142d5d61e37197e741dde05c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272148, "uuid": "5d8897d1-62ba-4c70-a9d6-fd5e30c7b1cc", "value": "T173343A23FB0C2422C492AF705D7B2BF6A339D9D25576A00961196F2D2E33BB0598377D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272148, "uuid": "51596ce9-fe2e-4bfc-b72a-4c162b4cc633", "value": "6144:0xVx/iO6iVfpZt1ZJ5NkZ7RhtSIlYV0K7Ui:e1t3fIlYKK7Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272148, "uuid": "0023e799-5964-4ae9-ad1d-0e0c7429f6b5", "value": 245376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272148, "uuid": "37ac1c0a-dea5-470a-858f-2a86b2f660fb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272148, "uuid": "7b17d636-53f0-4242-b7b1-6f9dd35faa35", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28216f4-e704-11f0-a129-42010a9c0007", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1767266888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767266888, "uuid": "59fd61bd-b302-48b9-9b0b-65196d766529", "comment": "Malware payload (ParallaxRAT)", "value": "6ae9b011bba0410a455f6b3405fb9b21", "object_relation": "md5", "Tag": [ { "name": "69-5-189-129", "colour": "#4D32D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767266888, "uuid": "6d1cea9c-0c81-4338-8881-d686a1f289a2", "comment": "Malware payload (ParallaxRAT)", "value": "bfa1ca2f1e2243a2a418f56fb1ea2f00a9d8879df336f85c51f05467b1266263", "object_relation": "sha256", "Tag": [ { "name": "69-5-189-129", "colour": "#4D32D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767266888, "uuid": "2cd0ae73-e971-407d-8132-0bc6281c00ca", "comment": "Malware payload (ParallaxRAT)", "value": "ded2de5eda4c205fc6c48d5fe883c68c130a1e04", "object_relation": "sha1", "Tag": [ { "name": "69-5-189-129", "colour": "#4D32D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767266888, "uuid": "fc78f134-42bb-49a9-bc68-2457ff00f45c", "comment": "Malware payload (ParallaxRAT)", "value": "4a23f503664f6e7f64d0edee97ff65b542f0e31e44bb0ec65e9254f6df54c1c62359cb90c5bc30ea1d1715be7bbe2d3f", "object_relation": "sha3-384", "Tag": [ { "name": "69-5-189-129", "colour": "#4D32D6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767266888, "uuid": "e11de45d-f452-40bb-b107-b13185496604", "value": "T19EF4CF4DB34A82E3D4C00C78E7A3B3011715AD7F6635D49BB1C8BB68DCED194DA89A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767266888, "uuid": "18457e16-76d5-4eb1-895f-0ba859f67628", "value": "151cb684d328118cbcb29c80e832621c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767266888, "uuid": "ad9d2c4c-b0df-4185-ac5a-c8383e444dbf", "value": "12288:2jY+DE3pRg7fMV6KS3DVpRUKf3LAkjCpsvjc2ypbvPZ3c9qByOBsdQ:VH3zg7fxdUKf3L5rvjc2ydvNc9qByOB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767266888, "uuid": "a2eb60a8-a453-476f-8940-cdc0514b25d7", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767266888, "uuid": "bd90230d-83ac-4979-84fe-66bfb24316da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767266888, "uuid": "5646dcd9-3487-4e73-b75e-8cf0b82b93db", "value": "i1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae07246c-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254747, "uuid": "c2dc4c68-3894-4fbf-b12d-c10210d0e254", "comment": "Malware payload (Mirai)", "value": "f00652dc89beaae9e8aea560bfd24931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254747, "uuid": "5caa0d04-bd00-403d-be5a-88f5580ac5b8", "comment": "Malware payload (Mirai)", "value": "c032550cc344c3f14b7c564ea58a3c5159ed4e8edb4266f59bfc3e7e8a13ea9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254747, "uuid": "bf84f6b5-a887-4260-810e-ffdc09b74420", "comment": "Malware payload (Mirai)", "value": "d69f2c085c8cfd6930b9d1ef55f87dbfaf686662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254747, "uuid": "b70057e6-e73e-4c93-a71d-0ccc68795aa0", "comment": "Malware payload (Mirai)", "value": "c0f33f64eb8ecc225546e72436f86029d69a611c6e8b2657e7ea2f175c3704e03f7b35cf7c5dce07fae58691da7c3f19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254747, "uuid": "6c81072e-07e8-4d97-abb4-41cad5549cbf", "value": "T16C13E1A3223EE6B1C4751CBD141D4284F17A2E86E587277F86C9657E0C3E624B229F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254747, "uuid": "1b0d4793-4977-469f-8a14-d8928c519864", "value": "768:uv6q4f/bZgfADLt6Wsd/JJgi5wUehqVhAPYO2xocizTGFsaYWyFSyg1Kn4RzsFBL:tfDfDLMWsfJ54GCceCFslWyFxISB/c8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254747, "uuid": "3a8cd7e2-f023-4602-ad06-a63e7de118e8", "value": 42452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254747, "uuid": "f96fe661-07c4-432f-8094-096fde504e2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254747, "uuid": "8e0d2656-b847-4737-b478-ba7c612502b2", "value": "m9x7k2v8b3.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ddcbb5-e74b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767297034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "fa38052b-9af1-4d63-bdb9-24c232d0cc13", "comment": "Malware payload (Vidar)", "value": "d2630f8852c8f5b1640a6c1c5613dcc5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "206c33be-e692-49dc-93a7-987403c170b3", "comment": "Malware payload (Vidar)", "value": "c06486083452957875c92062a1dcc3061fe2e89d56c1dcd2dafc6837c27c520c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "6c968447-fa34-4721-b1a7-94381b52a896", "comment": "Malware payload (Vidar)", "value": "2c494ba8118e95005dad757eef0d2dc84c432453", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297034, "uuid": "d980f22b-7f64-42ed-8cf6-2c19910a6d6d", "comment": "Malware payload (Vidar)", "value": "0366a2814da128607b42384b3f563b82e73fbfb30d8a345df1d89214905fa51b65746f1e7d0a071fba43129d6057c628", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "6b36826c-8cc0-4e9c-843f-e44c73e6d7cf", "value": "T11C14124186B47804E3BDB2FAE57F203C7E2E523EDE82B14B8115A764B7C49E5C8136D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "41dfe9ca-6214-4eb3-a196-4bd37df4a499", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "b1847438-9a6c-4210-9135-6f15369c5c87", "value": "3072:8GIYmr4txkkUm7OPnoIAk8kSrpQWnCFBIEgecgQGpnsdwLmiN4GgpZY+361ooulz:Xi4vv1kr/CCFB2SLtN4GVFeoG/+mH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297034, "uuid": "15b6db79-fb8f-420a-87ea-b1393bcc2dc0", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297034, "uuid": "d59ba9e8-84f8-4834-a0eb-35984409f26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297034, "uuid": "a8fe1815-8abc-4dc8-a27d-838c2dc15331", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2091ba76-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292735, "uuid": "6b246e39-606e-4b00-b81a-157c659bbec1", "comment": "Malware payload (Mirai)", "value": "96c9ad4493003c1a6e40633222b19d08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292735, "uuid": "0e1fd891-99c0-480f-a111-438efbd2fdc6", "comment": "Malware payload (Mirai)", "value": "c0ad67114aa018ed76115c05202956ca27cc36121b854df1d8885715c20a23ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292735, "uuid": "4d26486a-cec6-45f3-a8d5-57c5d2969b3b", "comment": "Malware payload (Mirai)", "value": "7f4b5e3793190ae1c4962efb285329af5709515f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292735, "uuid": "9da80ec4-fee2-4dbb-8dda-a59b2831741f", "comment": "Malware payload (Mirai)", "value": "4e36fc799dc156d09f841e279043f7d26cf3a97023a156afc4a9e66d43f041da9020b7e71dca41904c8ed1ae0181b371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292735, "uuid": "182e9039-a2ff-4654-81b6-e9efdf38ced9", "value": "T1B7D3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292735, "uuid": "c340dcb7-7fb1-4866-8793-6c858707b0d4", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Z56:xOFgpOEoVv3MXL5NhGO56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292735, "uuid": "28afe29b-c62b-4999-b1d6-cd5055794f99", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292735, "uuid": "c7034881-9ae7-48db-8a71-cb0c825224ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292735, "uuid": "f0a5e08a-6720-4daa-bd02-62c5461cfa4e", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e64bd7-e742-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767293284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293284, "uuid": "f10b25c1-3955-451f-9080-1284b82113df", "comment": "Malware payload", "value": "a556746cad55b53431c2e79704fb4e85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293284, "uuid": "19b25977-0d48-48f5-913b-81bab384c666", "comment": "Malware payload", "value": "c11e0cc976cfab67b4fc5a41c3023b632e1135dd086a8c0b6cbd1ed6833e7445", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293284, "uuid": "f920a34c-64f4-4524-a3f6-356dfdfc9584", "comment": "Malware payload", "value": "cbb7c460184ba38cf62de625ec68e4371dd901d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293284, "uuid": "67a7eff7-a96e-4c26-b97f-b82e6b85b2f5", "comment": "Malware payload", "value": "be22d982e298e5c6a24e64e37a0535bd92a70b20667d74baa6593397e922d000db2b37c668c5f9c25c6ee2ec086b9830", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293284, "uuid": "4a4a8586-5ba7-49fc-bb5f-c80ed5d1bb57", "value": "T1BD0146EA54F75D53D368CF4DB0BA842D9001D0C97EB2DEA4D83805345DC75496025AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293284, "uuid": "d64e5c46-a567-499d-98ea-9b88a0ffbbf1", "value": "12:3J3UUlxjJUUneKlCpJUUTiKl2pJUUcJUU+JUUm9jJUUzFG10jJUUwYhJUUkb4JUb:3J3VxjrlCpkKlk2kApmk1FuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293284, "uuid": "66f55b98-5463-4351-b55c-57fcb640e6e2", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293284, "uuid": "ee658202-4f72-470e-83e0-f939e6906bb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293284, "uuid": "f75d455e-0a2a-46a4-80e7-7b9d82c05edd", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9b3284-e6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253486, "uuid": "1a0dbc2b-2bd5-49b4-831b-94a232a1479a", "comment": "Malware payload (Mirai)", "value": "75241892686d016110eab68fe3886732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253486, "uuid": "7cff0ac7-1436-41f0-b506-32094232b7db", "comment": "Malware payload (Mirai)", "value": "c1ca89f51957c3cfe16976273d46bc5662e6ca611128d8339011c5992dfce180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253486, "uuid": "9e40131c-058f-48cb-a15c-36403d8f8c91", "comment": "Malware payload (Mirai)", "value": "ef1e20e2c0427c98d069e3b85318afa6dff5a889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253486, "uuid": "b0389fde-5b13-4cc1-8801-313c21d9e204", "comment": "Malware payload (Mirai)", "value": "40011f7cbfb5316ef2280d3d251b6d6f469b77a6ee392e84e0aecbe0508eeef448851d9aa93bab6a6187275ba81294e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253486, "uuid": "75647567-623c-4a02-9c1d-9454b6cab476", "value": "T164C44B55F8809F62CAC52976F78D869C73134B79C3EB720699144B383BDB86B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253486, "uuid": "b891162f-ed4b-4f9e-8534-ef9cce208d17", "value": "12288:KUHo05I+S0XOkShEWKm0+RCUVDxgpZ6mlq6Dg+C:ZHjIjVKS/bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253486, "uuid": "09d617cb-f47f-4345-af04-6d4178c5e7c6", "value": 565920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253486, "uuid": "8cd1ec92-5f0f-404d-a531-98ba87e6f486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253486, "uuid": "a2ee6eba-91bd-4313-868b-c45fa4091f16", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0422246-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233303, "uuid": "f503b9ef-a27c-4c64-bc1f-a0e0b859c5da", "comment": "Malware payload (Mirai)", "value": "13c065c95b35169ecb860774c939ed65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233303, "uuid": "19c20f81-81a5-4186-8dc1-c754d75181fc", "comment": "Malware payload (Mirai)", "value": "c265472e16dba6d2514e9fc457ad2f592241925958d331e8c731bffdf5dd7513", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233303, "uuid": "4d29451a-3271-4bbb-8b53-acb93d6376e2", "comment": "Malware payload (Mirai)", "value": "4ea1418fa73ed363aeca3076a416816c6f57d8d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233303, "uuid": "f2284a2c-75fa-4ddc-9819-1c089311ef42", "comment": "Malware payload (Mirai)", "value": "2993f2f6365874679615ac47a08beeccdebdf024836958f02b380b5746986aaa4752b987774bdb95bd9a9e53ab2da9f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233303, "uuid": "49a6c6b8-afdf-47b0-99b4-119482388cd1", "value": "T170430274632201B2E90519300BA74798231E0FFF82876962A15EFBEA5E061F9DD53DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233303, "uuid": "ef9ed968-58cc-422d-8cff-14f082e6456b", "value": "1536:t4kKad2CGj1NUqIpaBotfHathOWSQEbgwbVJue:yyqxt5B77CgwbVQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233303, "uuid": "bde73d73-7910-45d2-8d4d-6b98cc83efbc", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233303, "uuid": "17f5bc7f-69bc-4d2d-a644-b9568461ccc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233303, "uuid": "ce9ec18b-eeee-4db5-84a2-36c593659238", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ee141b-e73e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291474, "uuid": "ec5af14f-ad80-4162-b335-38bd83632ac7", "comment": "Malware payload (Mirai)", "value": "98a10eb39e0ce2a841bc562b1d1dbc26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291474, "uuid": "8593f840-5ea9-4e4b-b6cb-d861edbf2a02", "comment": "Malware payload (Mirai)", "value": "c29c5c6adbc0821c978ae674aa8fd88ed2fff90d4178513f4baadaf0ec7f5048", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291474, "uuid": "332699e1-7e2f-43a4-a6bf-8604992e017c", "comment": "Malware payload (Mirai)", "value": "27c9ab9f471ba13a0255b91677f9234de77a0b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291474, "uuid": "484de085-6bb3-4b5d-a85c-33fefe34efd5", "comment": "Malware payload (Mirai)", "value": "9eb43c40a0333af3f49de27638b95cde3c320d4a67bd9fa82a4e0b57c09ab58a9fc184d11539da3957b5840f36a97e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291474, "uuid": "69686b22-e25b-47dc-9d34-06018ed4e6aa", "value": "T19B5301F690D8BECDC25A5770020B0A473EC6A7B85049653BB2C4E6A58BF5740CFD8BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291474, "uuid": "6e0e83a2-7f98-4db9-bf4b-d27c5f88ebe6", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA8ALkg4azHh:CM5az1Fy0oPgdZX6hTo8RaLGazHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291474, "uuid": "8ec3bb17-7baf-4536-bcc5-44a098e6fc75", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291474, "uuid": "89ff7c59-006a-476b-ae3d-591f91bbcf01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291474, "uuid": "0a385d5c-8b68-4ff0-b13d-7b9ec76efdef", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9842b6-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292379, "uuid": "3e6e159c-756b-4b22-85a2-8fcef508af1c", "comment": "Malware payload (Mirai)", "value": "2b899c47f7fc143cd40a80a2ba57e6cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292379, "uuid": "7c0abe76-0f8f-424b-95cf-61002f1854bd", "comment": "Malware payload (Mirai)", "value": "c326ac45c16333c92bf5be2af8b88198b30a1fc892ec29412cdd3c59a66a9095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292379, "uuid": "f5fa353f-44ce-435b-b791-4bc6f50cead6", "comment": "Malware payload (Mirai)", "value": "72bff23617ad41f067ee6e19ef273c7e9057767e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292379, "uuid": "4b093b21-0afa-4a25-afc0-025ccbdf7b2d", "comment": "Malware payload (Mirai)", "value": "0154e5f2bc15f1346682611b89ce41759ecb279e882cb44315150bb20afe1d10ebb5bfe11fb9037b14b632b261615843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292379, "uuid": "16b9c285-e029-4504-9a4d-10252b8ecf4d", "value": "T11203F1369635DFB1C7A044BDCAACC775337A058BD197B02BA208071CA71ABCF5896DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292379, "uuid": "bbee7a2a-81cf-4b21-8ec8-4d977936fb94", "value": "768:QEhoRW5hKFGkVmpZYLUiOPAFPSZ4oViLmxHGAuuZsusp9shZh8yHs3UozT:NlKFnu6LgC6Z4ocMXuWsuSs/h87zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292379, "uuid": "b52bc61c-ab67-4398-a6ea-9efd9dd0158b", "value": 38328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292379, "uuid": "ff1911a4-8521-4797-906b-61df23a9b04c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292379, "uuid": "fe2a7351-f073-4029-bda4-51ca9394bef5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb6d047-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272138, "uuid": "1c6adb78-c0ed-4ef5-a199-418520e641cb", "comment": "Malware payload (Mirai)", "value": "af052f62c41722b997ed3c636f829030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272138, "uuid": "f300fc67-272d-495d-b1a8-ba66e7da27f6", "comment": "Malware payload (Mirai)", "value": "c35f16fa3a5aa761406585e5088a0f4c8a6a27ec504e938b50d09afe3bff92a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272138, "uuid": "9f116b61-ce1b-410d-a2f5-20dcc0972580", "comment": "Malware payload (Mirai)", "value": "d885e395c0a3b469bde30c938fa298d042cf73ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272138, "uuid": "5c623f35-b8fc-4272-9552-6cea9906ed55", "comment": "Malware payload (Mirai)", "value": "72a038cb507e966a10c7d284fb47071a25c397cffb92dd88d882dd52c543949ff68819b497d0d7caec8e16c8dfe1f810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272138, "uuid": "601d8e3f-0281-40af-af04-877b8293ef58", "value": "T117F37D06F692D0F2E59302B38057C7A55734CE310366CE06FB586E39BD326099E5B7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272138, "uuid": "babaed93-d687-47f5-b33a-d71cc1bc6316", "value": "3072:7Yz7GgGqZtXToykc7JCSkDVaPsp9tilM7WTF8aIidFybjSlzemXC:Uz7GibkcksGilua3F2WdemXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272138, "uuid": "7e52ebd0-8546-453e-a288-489a627bb829", "value": 167256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272138, "uuid": "ff3a6349-6106-44b9-b468-f88e4854feba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272138, "uuid": "221d78d5-01e6-45ff-932c-6523ce8b890b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b83247-e6f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767261422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261422, "uuid": "3ed82443-0c2c-4c39-b607-13282a459c92", "comment": "Malware payload (Formbook)", "value": "e42930f0ac7c5e2a07a6e31880ca5d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261422, "uuid": "12201875-65fe-4b27-8059-2f096ac0a3c0", "comment": "Malware payload (Formbook)", "value": "c38bf4313b8f4cd5a20790b4e52f431e125551d049dfdddf1a36bb67733041ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261422, "uuid": "4a001830-66d9-428a-9306-e34e5c7ce453", "comment": "Malware payload (Formbook)", "value": "0e51a9ddedcca8c872daff7495326a78991ee034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261422, "uuid": "976de8cc-2b11-4ec3-99a5-6d14b80d014e", "comment": "Malware payload (Formbook)", "value": "40d578e8f4fbe03329e987f2d5e3b756fdc48a6211889f63a8582b3d749a0ba42f14451272c81c0f305716c6bd007f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261422, "uuid": "6958c091-4bd9-44ca-a4f7-a4fd41dad28f", "value": "T17CE40245274EDA06D0A25FF36872E1B81B79AECABC71D2438FD63EDFB479A404865301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261422, "uuid": "7d4051c2-6bde-4885-a670-15592f858781", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261422, "uuid": "d6b7cc6c-c9ec-478f-a045-ff8fc17e0f31", "value": "12288:myRrhNLQT8qPZUmJK4ho3CFsCQI0s1vTE/FqxSgJI3PW27878ez8Bc6:jNtI3PmgZi279ZxSb3O4c8Cx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261422, "uuid": "9cd7fbd8-32f8-4be4-bc0c-54f4ad7905fc", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261422, "uuid": "82c5fc7c-132f-4500-bf0e-890eee8d924d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261422, "uuid": "d67988db-30cf-448d-a6f0-74d41b4feca5", "value": "PaymentAdviceMT1003.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb7179f-e74b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297077, "uuid": "068adf63-5ac6-487d-b141-7d595f9461b2", "comment": "Malware payload", "value": "6ffbeaa763ff79ea73806b96c4cd9186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297077, "uuid": "a6db84bf-eb2b-4f05-9eff-218c96401883", "comment": "Malware payload", "value": "c4f5eb8d6b1fe7c8da64dd1ca4e1413544386c9bd82a705a3db9ae0fca24e51f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297077, "uuid": "8adaf6bb-dd59-4d3e-b5b0-5826bd55f5b2", "comment": "Malware payload", "value": "c1a5c8fb19c374c9962fa21d8ef8f5484d7943c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297077, "uuid": "d6ae65cd-1f3a-4c26-8934-b73766063a19", "comment": "Malware payload", "value": "08bcfe5c3247506a48b254f4dcef2c44c1ee95f510d141d3555905bfda1d77027b909ed14ad632c6d37bfb8c4b64832d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297077, "uuid": "0159f0bf-d225-463e-8ee6-588a435946e3", "value": "T17EC41A7DAC60F362F608D0BEE185D3529E2178110236AAD319BE932412459B3DF5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297077, "uuid": "9ae020e9-8ee1-4d5c-9f70-2f6b7aeb6055", "value": "ec4a3e507f2cadcaf4f3ba70774863e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297077, "uuid": "4fe94126-f46e-44e0-9d5e-1bcb8e3a7127", "value": "6144:5iy/0WhBGtUK8z88VeLQiI8MvCobILNkJnDCikykXhCgp/1JsUzvE4w6JOOunamb:ncDv87KkkykT/sUAgsdBiBNlin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297077, "uuid": "bde1102f-74c6-4d89-8654-9cb861f75a76", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297077, "uuid": "18a63a74-508d-4254-b9b3-2a304571eff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297077, "uuid": "b222ffc4-be9c-4f71-a086-26f978b469a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbd3245-e71b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767276413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276413, "uuid": "ef44cd10-077c-4571-adfc-fac0fc8bf1db", "comment": "Malware payload (Mirai)", "value": "1838f5ac88dea194b241a60c6176cae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276413, "uuid": "c390426b-48f9-4193-ba05-042695e51cde", "comment": "Malware payload (Mirai)", "value": "c60fd3a2464041098378df3bd5cde42ff05d22ea1525a93cd33c1f664b936f83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276413, "uuid": "094ffc53-a1f0-4e72-8619-0923682875a4", "comment": "Malware payload (Mirai)", "value": "7a2ad2c2c1c806b301a1c36e96e8616bbf908933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767276413, "uuid": "f73d087b-7172-4c3a-9e1d-ec42eef4134e", "comment": "Malware payload (Mirai)", "value": "ffa13fb4313afd1d07b2921c09b8d958e0e532bcb9cc9ee5d6f44cba48be1324a1a6e956e833e01336b186d719bb8410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276413, "uuid": "e5ecb788-9891-4ab2-8082-abff443f1e84", "value": "T1B2F38E87E343C1F2FC5A12B4606BE73755B1E93D002ADAD6DB75A931AC11642E62B33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276413, "uuid": "a32ffdcf-8194-403c-954e-caf6b0760e4e", "value": "3072:UUDSulBtKx4ZZIU+1u26mUkK3iKEOKSnUuInT/Xq5EM:5DTXKaXP+1u26mUkKfEO/y9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767276413, "uuid": "f03bab98-fd92-4262-af67-4f6343d20448", "value": 162612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767276413, "uuid": "6158d9ed-7d6d-4d40-bf7d-b6473b355cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767276413, "uuid": "8ca559ca-8d66-4866-b192-0db649e61c2d", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd1029-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767252971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252971, "uuid": "2b3ecd5a-24a0-4fef-95d3-f9b23c987d8c", "comment": "Malware payload (Vidar)", "value": "2438699d5edb260a9a930fd2232187eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252971, "uuid": "adee66da-3174-4cdb-a439-14f0a9d29010", "comment": "Malware payload (Vidar)", "value": "c6fec708a86e1c7c05a687ddde264bdfde77e8bcd31f56d031f05a6775820841", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252971, "uuid": "7f1b06bd-dad9-4410-9201-a6976976ab5c", "comment": "Malware payload (Vidar)", "value": "ece58256eee6147e44156d70c60c2539af49d2cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252971, "uuid": "334d0167-77b1-40e7-8c0b-f55274dfe0f7", "comment": "Malware payload (Vidar)", "value": "48ff215b25489a7a3480ff57675710ade27d060e33d9236ca160a1e35f7ffc7045fc41c6c864885bc01796031760ef64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252971, "uuid": "eb165125-f0d3-4205-8aa8-2753b218128b", "value": "T1A24601496256C4E7EA97597157060022E1733D378364AEFB87A4972EDE4FBC02A3C372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252971, "uuid": "d0dec737-9361-4e89-98a7-33ef9a0470a5", "value": "cf044a6898eb338631b1a53e8634e95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252971, "uuid": "4b1c268a-e204-4e70-a513-07b9fe8794cb", "value": "12288:8LHIYRXm0vOMP+5AoEU8PYEd5XSRWlQUV6p+eUGaQt6HakIRDesas1:8bIY05GpPt5IWlfKVjahdIRiu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252971, "uuid": "02051b31-0bba-4e9a-ad50-92cd4655a750", "value": 5612544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252971, "uuid": "306a6d3b-6499-4874-bcb5-0226f29ec7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252971, "uuid": "41dd599f-080b-4c42-b537-34bf2eb53e42", "value": "python311.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0127fa84-e6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1767231264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231264, "uuid": "98ce20c4-d357-4e29-ad63-4421f1884599", "comment": "Malware payload (XWorm)", "value": "4fa7d3830d71da6bf30fbe2c2b6e994b", "object_relation": "md5", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231264, "uuid": "332c938c-e62a-4643-8ae9-fb2dec94c1ae", "comment": "Malware payload (XWorm)", "value": "c76a404ed3a2dd14dcf2f9d6b5cc30eacc919563ae9c1f5c32711e572662c8fb", "object_relation": "sha256", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231264, "uuid": "36d524ec-27f6-4146-bac7-b9643e2d3205", "comment": "Malware payload (XWorm)", "value": "a329e5678ed7e356c0184e2c644101e6549afd7c", "object_relation": "sha1", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767231264, "uuid": "504038ee-cdf0-47ed-a64b-88433733c76f", "comment": "Malware payload (XWorm)", "value": "bbb5ed6a95dec96c35e958c50a4b5b397f7c1bcbc7250da5c5460429ed576824c6798563d9bbaad39261c2c4110a3c60", "object_relation": "sha3-384", "Tag": [ { "name": "23-26-108-156", "colour": "#B3C4B3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "nkprotect-net", "colour": "#8F5503", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231264, "uuid": "d861b494-ac15-453f-904a-2f5bff813ff3", "value": "T15B813444DD2D007AFABCDD9FB4BCD99F3A61512B96C83E5EA16FBCC18DA52417040A0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231264, "uuid": "e20f0e06-060a-49c5-867c-995de9bf6a08", "value": "96:ZaNnDrPZprAsoSDci4QWjCfBdHSBckhRlA8U4m:ZaNn/ZpEsoWFkm4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767231264, "uuid": "c0b6a687-6647-4512-a0ee-923e36d3df07", "value": 4115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767231264, "uuid": "9ea71537-2ba0-4097-9650-b25fb552eee4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767231264, "uuid": "487b8498-ae7a-4206-863c-6c6e697316ba", "value": "DOC -HARLegal.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f616f093-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226092, "uuid": "553626b2-e66e-44ad-b1d4-8de4823d7031", "comment": "Malware payload (Mirai)", "value": "913798808494a652b8c9f2581130e97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226092, "uuid": "61d511ae-c27f-4d97-a299-6a4dbb0bdd9f", "comment": "Malware payload (Mirai)", "value": "c7955382e5f339b17bdb195de8052928de11112d1f7aa9d6baf5b6946d4aed54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226092, "uuid": "8ee99d66-ed42-4d73-97a5-3fed8a903017", "comment": "Malware payload (Mirai)", "value": "48ff7c138e72a6bea88aa50ec28f35ea41c19f2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226092, "uuid": "01612fe5-b226-4dcd-90a6-d31bf47b23de", "comment": "Malware payload (Mirai)", "value": "6cf0167d195f64ec1fcb28e241946c8327624184452d58f214fe67ccd5663439278aabd62e2615197129368cdb655b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226092, "uuid": "fb3cda52-4617-4dff-aac8-8e05a582e512", "value": "T1A6530945BC81DA27C6D462BBFA1E42CC332653E8E1DE7207DD116F15778A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226092, "uuid": "0851a0ab-628d-46db-a030-7623255c31f1", "value": "768:89B/+6GJcTlMhv7p9qS+F1WarnKIC6Mbkd7evXmNdQxVBiko696ocu+7R:6/7Gj9qnrprnSlkZKKQ88Mu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226092, "uuid": "72f25c5e-0e1c-430e-a1ae-31be6336d607", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226092, "uuid": "9ad66eee-1d86-4d85-8618-1ba64b7cbeb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226092, "uuid": "8b5bb634-61b3-41ee-b854-a1ec0107c9f4", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15fc322-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226084, "uuid": "ec0af1c0-dc90-450f-952c-6bf5cc6a20e0", "comment": "Malware payload (Mirai)", "value": "0148c9561e718cc31687fed3dd6dcf5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226084, "uuid": "564e9a70-eff2-4ad5-bfae-8ea40a4581e0", "comment": "Malware payload (Mirai)", "value": "c80df525660ead34a1d27879cc000b76a3893104b0bb14daf80c9d292b0e7090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226084, "uuid": "e1be228a-7c05-48c2-92d7-9cc006cea2d2", "comment": "Malware payload (Mirai)", "value": "55f4655d0864a21b54a5bba3a7ec3f9a03d9ba47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226084, "uuid": "c8959979-d664-47c2-8213-4eb3cf3d75b0", "comment": "Malware payload (Mirai)", "value": "bd0899b826ac6abfdd5621935d7a2248bb636594c36eafacdc46fd9535c24ba001f3647f624d8399d3b05ced45366cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226084, "uuid": "f4a4cf75-cd14-497a-84c7-6258154a1957", "value": "T180335CC59943E8F4DC1A057E2572F3325BB6F139013DFAE7E798A926AC52740A5063CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226084, "uuid": "9de906d6-173c-437f-8702-72a187b663de", "value": "1536:HqHhYIAm2xdYY+zbjam1RvUiPHrG6t7RwfHKb2rXKZRO:HqBY1m2xqrjamnvUiPHC6t7RiHIE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226084, "uuid": "5ccc49f6-e466-4c23-8166-db8f6d388f8c", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226084, "uuid": "a25c26fd-c45c-4c59-8f60-0f331973ed4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226084, "uuid": "635e8466-64eb-41ce-bca2-833a5fc5f449", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdf027c-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767228141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228141, "uuid": "9807d319-5a65-4a51-a7fc-bb79be09c878", "comment": "Malware payload", "value": "087baea07c8ee0e96596192a6443c8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228141, "uuid": "66173bab-1705-4b6f-a4fe-bb615c48d2ef", "comment": "Malware payload", "value": "c9052fcac46be58851e189cbddcc14c25ef75ea3cfe47045c18c2a1cb21d4a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228141, "uuid": "eafe6e3d-b6f0-43a6-9107-c36ad876dddf", "comment": "Malware payload", "value": "3e6bfeb33882136f3491f30ccdc0121f00c3e410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228141, "uuid": "657526f2-a446-4421-beaf-3f4e7b170fb6", "comment": "Malware payload", "value": "d694d19b1775343eaecc8e6c8a04ba78ac0a94075d7ae73bae03a244bd14b2f66e3a75c68e06552ed90b53501374263a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228141, "uuid": "ee52b973-9a82-4acd-a1ce-c53f9183cf9d", "value": "T1A2A4217D8E2E93E5C1BACAF0BA31C2D6F5103948907596C62BC047AC6713560EDF63DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228141, "uuid": "98e7953f-5c49-4d1f-bff3-863583b544d5", "value": "510eeffba4fa5e8ef9d6050a17892678", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228141, "uuid": "6e5bd5ba-e5ad-4be8-a57c-1652b13471f7", "value": "3072:WkO/pdRLaCbaajbvv/krm0Yfp2lFzKcKXiqaImDXtFooqluPIyC3xnP6JtSxuOiM:G7aSKLmOqhsLEci6sGweb6nDABqNQUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228141, "uuid": "769d4ca5-5a03-485f-9a2e-6beaf5e3b2b8", "value": 487680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228141, "uuid": "3a8e3a89-6a62-4da3-ab5f-685b4b17315a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228141, "uuid": "385bb44c-b454-4d42-900c-bcd3f2baa537", "value": "2025.12.30\u8fdd\u7eaa\u5904\u5206\u540d\u518c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c850ad-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226435, "uuid": "3fb81c4e-0ebb-4b1c-af90-750b847f7246", "comment": "Malware payload (Mirai)", "value": "81d2d860608dfb3cf21fc6bf8a7772f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226435, "uuid": "14b36ec0-d0ed-4fbf-9dde-4904746e867c", "comment": "Malware payload (Mirai)", "value": "c9bdd869a9c73547135ec5129b3726b211257f30f2a16b45f174c82a5c3bfdb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226435, "uuid": "50ac0dbc-177a-40b4-a1c9-67cef5a0882f", "comment": "Malware payload (Mirai)", "value": "7710c3059fc1787721625ffe25744c640404edee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226435, "uuid": "848dcc29-7887-448b-b9d9-f0de34d14dd2", "comment": "Malware payload (Mirai)", "value": "0b2df1a89dd050b43a8005785382ad4aff079da3394b8d3b94a8239527fb922e069342fa8f52ebbf789bfe65e1b1906c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226435, "uuid": "6a02d9ef-533a-4ffb-99f6-0aa97c4364ea", "value": "T1B543D64AB991DB15C5D5517AFE0E528D332307B8E3EE73139E14AF246B8B46B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226435, "uuid": "4110e609-caea-4f67-9f41-87810dc08394", "value": "1536:6hnkLXDq3jcxReswgHwedODnMsF98EA3WM+iEyumkgCu+7R:bLXG3AengHwedObMsjyumkgCu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226435, "uuid": "90987de4-b0d9-4421-8bf0-c05ca65653a4", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226435, "uuid": "a032ee85-eb3f-458c-bb58-64ae53dbd892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226435, "uuid": "7f2a448b-fe32-4a56-be79-8b5c365df00f", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7412e56b-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225873, "uuid": "d603915e-b795-4a2a-98d2-297f1ff80344", "comment": "Malware payload (Mirai)", "value": "3d808934de655d46bbe1cdc7d4a4023c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225873, "uuid": "99f91099-6585-4182-8479-4310e7e3da31", "comment": "Malware payload (Mirai)", "value": "ca91bed2ce6e308d8b402ba02bb161f0127a8b2d43bf7c22fa73815531eb6bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225873, "uuid": "d6b936e8-88de-4139-9913-001259a9efc9", "comment": "Malware payload (Mirai)", "value": "038bed2a2e6689b2ff24cea2fbc49f608ca55e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225873, "uuid": "599c8332-a769-4122-8b85-cacd68508ae5", "comment": "Malware payload (Mirai)", "value": "ad9ab4c3771a3bcd52824d808bf37a15cb13c8cc19576c586ccbd59285253600145f96e727ef29ca83be38243458358e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225873, "uuid": "0624047d-bab3-4614-bab2-7d4e92aafb38", "value": "T10214AEA3B70B18C0C82106F81BCB5B9D6E2311139D67D6E3BC6E36396E765DE19213E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225873, "uuid": "7729d2c7-4ca5-4388-b856-bef9f1b57a9f", "value": "3072:mldIMO3IbCGPcvp9TzOQaeL0SvnfErsvQyXvvYSgzCoeRvC6ub01OKq:UdW3IPc76erfEr2bnYHCoeRcKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225873, "uuid": "8e7e7dc2-c205-4038-adf9-f3656209ff71", "value": 198564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225873, "uuid": "416e5d20-c622-4031-904f-ba9034a6b977", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225873, "uuid": "d0a66a94-96ca-4c75-9dec-21318c8fd69e", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4064413-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226813, "uuid": "92a55008-14b0-4251-bead-7f5b6b3f6ae6", "comment": "Malware payload (Mirai)", "value": "aed7f7608d1089bd807a3cca76f84197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226813, "uuid": "c3713805-464d-4e6d-9468-32b922f1a6c8", "comment": "Malware payload (Mirai)", "value": "cab3b8f265ada07080aaa9e70fd643375544a23d41ffa4aea1fb126b4321b845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226813, "uuid": "0530bc08-a2ad-4ffd-a70e-2b1b16f9bee4", "comment": "Malware payload (Mirai)", "value": "67457440627e09e6967c15bda4fbc8fc6ca2755a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226813, "uuid": "2e1ffd8f-89f2-4103-9733-4a6803e03f91", "comment": "Malware payload (Mirai)", "value": "04f0ff976f23339bc87edda658e2e45a666d4237eb057f9a33139fe6b546424fed3e3c77fc8c2899cae3eb42398c5d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226813, "uuid": "422e59e7-68d1-4212-8daf-a31c954776cb", "value": "T178536E4233184A57D1A60AB02D3F1BF183BE96A021F4B3C9B54FAB698575E331086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226813, "uuid": "3c78b981-5d7b-418b-8f5d-87a89fd9bca5", "value": "1536:4bFWUG6/mRupO25t8jjEGIqkKfezHTFHlu+7Rkn:MWTL2388G0HTFFu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226813, "uuid": "e47f1228-f35e-4def-a57b-737515daefa8", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226813, "uuid": "7099db06-cd02-43ca-8be1-a7941da716d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226813, "uuid": "029a2d9a-af72-4a04-aacb-aaad83627b75", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d0e0a5-e721-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767278965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767278965, "uuid": "431608c5-28b8-4227-ac79-34b28ba5c559", "comment": "Malware payload", "value": "15ebb9dc17a058a270d5f63785b3eb96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767278965, "uuid": "4f9c83a4-6a21-4d03-aba3-0c4a8e68f9c2", "comment": "Malware payload", "value": "cb71327bc7563ed2fa17b9a1ce186e4af9e78f3693a77a877ac572db6425dc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767278965, "uuid": "8f5f454d-2962-4802-9604-738e8a703650", "comment": "Malware payload", "value": "1cad69d40b4cdbfcc7fe1269fe9c924593c67682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767278965, "uuid": "8136aa6e-5983-4895-bd56-1cb5184274e6", "comment": "Malware payload", "value": "ec78161427c4135d08093752a75f774a6f4fecbf7e7b2242407f79111738833d36787afb8608c27cd9ae6f3e8c270558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767278965, "uuid": "730e946b-58c2-48fa-a215-1d6fd385f83d", "value": "T1769723D3A5DAA2F8C0C70604614E11CFA4D164FFCAFE9A5C2EC69C031951FAA499D7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767278965, "uuid": "a2d86154-e840-4d1d-b5d5-e561fb213a36", "value": "4dfca7bacead15983696cc06c3e2ce10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767278965, "uuid": "6d0f6d9a-de06-481b-a8ce-5c0ba5d99862", "value": "786432:OOEthdnvE7wwqGgdhuuEOS2hIvwiVrES0nDy4Dpb:XwPccwqG4Eu9FhiXgx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767278965, "uuid": "f47f0cda-d4a7-4318-9809-854b68e33127", "value": 39818240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767278965, "uuid": "04773b5b-7799-4266-b17f-cae2d388b67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767278965, "uuid": "b388e6ce-d476-4227-80fe-ac9f0d0a7c96", "value": "erto3e4rortoergn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12987071-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272096, "uuid": "611b86df-1aff-48d9-aac2-63e2ccae1db6", "comment": "Malware payload (Mirai)", "value": "e25247a11af3a8695f6976037dc4c647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272096, "uuid": "79dafb56-03d7-4bdb-b4ea-3008de83b80a", "comment": "Malware payload (Mirai)", "value": "cb8f8a1cec97a7c809e95ba05445382e84c8c3314e40fd9217b5c409cf6e7f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272096, "uuid": "136984ed-3d18-4565-a245-1a0f9a1bc5be", "comment": "Malware payload (Mirai)", "value": "6769eda8f7d9dc7c2e4ce105c7490aa355a0f4a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272096, "uuid": "4e67e9af-fead-4219-99d9-2e712e454fe8", "comment": "Malware payload (Mirai)", "value": "facd094d665beec03d5712c2c7a4b259bfe695c8b7a2d1b3eae4b6e2f9822c5a3917233ea640b195962118670b0a4227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272096, "uuid": "58680227-2967-429c-893a-a895661dfbc4", "value": "T13FB3121560DBC529CE095E7D1186FC69FF91FDFB181E96653A3C28A2B2366C1B9C083C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272096, "uuid": "9c2bceca-39d2-4fe8-a52c-1d2e912dcaa0", "value": "3072:QF7hIvLVg76ijJ5hZtkpgyC440nsIkX+TZhuns5GwVK3e6soHH:KhP1JrZ+vpsGVh5VM8on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272096, "uuid": "2f210e40-d88b-4f4d-8587-42f2c30c8c87", "value": 117080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272096, "uuid": "f3fa1e10-d3bc-4fc3-a73d-f7f89d6d1d1f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272096, "uuid": "050902d1-3a78-470c-98a5-f7a617e09a5f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f6fa84-e746-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295078, "uuid": "bb4b89ce-d621-4171-81d8-9383c83a41b4", "comment": "Malware payload", "value": "be11a6dd449557481fd786adc586e1db", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295078, "uuid": "1fee40d8-af4c-419a-859d-2ebcc606d62a", "comment": "Malware payload", "value": "cbaa689f690bc2a58f46f20db782d2a9ace07bd1c4d7892d6cd2339c0ec0ad9f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295078, "uuid": "59720fc9-b5a4-4b04-b3c2-c312c4f8ee0b", "comment": "Malware payload", "value": "646f722242faf3a8cce4eb2f3da646f82bf8628c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295078, "uuid": "eab844e4-dc6e-4257-81bd-f483937a711a", "comment": "Malware payload", "value": "cfa97c5c629f2cf5a38d6e986607a659e19363e53e9f266c523616bc8b385fed69738c9348c6c4dbda6b512c161548b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295078, "uuid": "7ed1d36f-00ea-49ea-806a-4997b20180f5", "value": "T1C211C4EEB0105A92168D8F4573B38408B840CBD9A5B75F696DD804FB4EC6704775CFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295078, "uuid": "f5030c4f-b785-453c-ab1c-5075509ffb0e", "value": "24:jdRHdR3VdRhNIQdRxKb8dbbdnndZTdC/dLtwId2XdlAwDdmv:j3H33V3L3xvZb5fTOjUdDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295078, "uuid": "8303c249-44cb-442a-a102-2c992aeaf5af", "value": 887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295078, "uuid": "d528326b-0d69-4a2c-b827-620d892c8a6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295078, "uuid": "d2c05baa-89d5-4938-aac7-d6248b831396", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8921c352-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767252967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252967, "uuid": "bc787c55-3a80-40cd-a2d0-d3c8e653b621", "comment": "Malware payload (Vidar)", "value": "73a30b6f5afbb121aba16217bd902ae4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252967, "uuid": "3b1c2d26-c60a-4cf6-ad74-ad684f3b493b", "comment": "Malware payload (Vidar)", "value": "cc482813e22e8163d60982340dd4ec13e316565f0e6cf455d07550ccf348858a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252967, "uuid": "1723b308-b340-4688-88f0-d808cfea718e", "comment": "Malware payload (Vidar)", "value": "986c89a36f819aadbc8eda8c078a4d65d58d7efb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252967, "uuid": "5bb1bdac-0dcb-456b-8c86-27ff1b7ce715", "comment": "Malware payload (Vidar)", "value": "cabce2c5441d717c7b4991a6b6181fd9b968951aea33ce3d907ae7097eda2f82f211a88e96ab04fa97e068b6a006a458", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252967, "uuid": "b2917ec1-6944-4b04-af5b-c5cfd53627af", "value": "T1B1463A52FE415158C29BE238DD7461957230B458037823E37BA34EB65DFABC42A3BF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252967, "uuid": "62093e7b-4471-4698-9f27-5eb83fee022a", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252967, "uuid": "d177643b-14a0-4592-bf17-df113740837a", "value": "49152:ZZbLEfrb/TlvO90dL3BmAFd4A64nsfJfKeIK7Hje0xn+AohtTsWMoCK1rwnFeEBa:ZZ9LQwUakyIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252967, "uuid": "b0f627c5-ffec-46b6-ae5c-cf29dd02c08a", "value": 5677696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252967, "uuid": "4ffdf5f4-b27d-4d34-809d-8859fd2764c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252967, "uuid": "6d33fc8b-06b6-48e1-b585-92263411d05e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d638a4-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270484, "uuid": "0b0a8b12-de49-4896-a093-632ca022023f", "comment": "Malware payload (Mirai)", "value": "3b9d90b9749661c3e13611e57be97888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270484, "uuid": "1414d7c0-2d41-4be3-9982-9dabff6cdf83", "comment": "Malware payload (Mirai)", "value": "ccb21cb146d43855237ce3a282d9f6c45edba1c90b366d87c0cbf41e4071451c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270484, "uuid": "82355944-75ec-4d9f-869f-12817d577a00", "comment": "Malware payload (Mirai)", "value": "4cd1ea98185a9d8c06505c1a3726088ccef212e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270484, "uuid": "bd44f0de-0b65-4ac4-8a5c-d9cb24281019", "comment": "Malware payload (Mirai)", "value": "32486a163efdf6619326b1b3a5586a5bd0b2d78bd4331b40ad1805d5d69d5cf809218a400509fa7ae0fecbf0b1c9b6ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270484, "uuid": "0ddee5b0-bf77-47fc-b079-da52fefa9983", "value": "T13873A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270484, "uuid": "2e869639-52f3-445c-a2fe-6a7958862fd5", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5r:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270484, "uuid": "1b8df184-b38e-4f1f-b9cb-9b9f0fc659a8", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270484, "uuid": "5e6d38a2-ac15-43fc-ba14-12dfaa37dd47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270484, "uuid": "153175ac-ead1-4cd9-9c24-aef649e00968", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421bc835-e715-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767273893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273893, "uuid": "462d263c-c316-41b9-bcd9-03f85362072b", "comment": "Malware payload (Vidar)", "value": "b56584587b8945fc943c72477ca33d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273893, "uuid": "87446e63-0f61-4a66-a601-8cc76fd19587", "comment": "Malware payload (Vidar)", "value": "ccbf75e236bebe168f8c8becaeec926bf24f678fcfd178cda4cbdda683782b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273893, "uuid": "287a1d78-892c-4ed7-a640-830e865715bb", "comment": "Malware payload (Vidar)", "value": "c71e8edb7932e446dbfc3dac9151f611f2f06f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767273893, "uuid": "9c9f29a0-7b70-43f7-9722-cd0ce8b73f50", "comment": "Malware payload (Vidar)", "value": "b65980a3a601adf4c9f2ba12e7adf7779f72e68bd07a0e2ec475979a4a4b66eec63589ee09bd8519c299e4a3ce4c121c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273893, "uuid": "a5584f51-6213-4168-8be1-055cc097567e", "value": "T18DC62883AE504225C59FE239EDB1624A7230B545133116D37FA70BB98DCBBC4973B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273893, "uuid": "b8f52b32-880d-4c3c-b223-f63233e5f7bf", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273893, "uuid": "34ebf7bd-4cf9-47e4-ba4a-6c444be4fb85", "value": "49152:46I+mGe3rb/TlvO90dL3BmAFd4A64nsfJpY46TAEikGAd8vQ89BeaNJIy8oOvYuJ:46ILq+8rWq2rqL1PbJ87TwJQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767273893, "uuid": "47a3502e-3757-4730-ac7e-254762453de5", "value": 12262528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767273893, "uuid": "54b4ae78-1ef7-43e2-bcb8-7ba900f9f34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767273893, "uuid": "9980beb0-7371-4a2f-8506-bec71c2f8dfb", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718c63d0-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295448, "uuid": "76f6c118-4e01-46ca-be9d-df1a7c791233", "comment": "Malware payload (Mirai)", "value": "e537f7829a1e318498e9bdc7875d1c14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295448, "uuid": "b5965f11-6b59-4deb-8a09-35abf6745b2d", "comment": "Malware payload (Mirai)", "value": "cd315425c67cf9c5e28f1bb5c219008e4a3986eb2c5b61cce2e2b88aa9386749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295448, "uuid": "e647a45e-a180-4fc8-8769-7d82e3ed6d60", "comment": "Malware payload (Mirai)", "value": "590a3180b24313ef486c39df2792a467145a63c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295448, "uuid": "e83616e8-52b1-4fab-8ce1-a3aced7d9b8a", "comment": "Malware payload (Mirai)", "value": "97a26702f71b7c580e54526c52f364ae72d57f67506309d258f1b692e623129d5962cab5efc6ccb45bfa37298319d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295448, "uuid": "0258bbd6-0f24-4fd0-983c-40c75dabae16", "value": "T17C934C22B9B50D2BC4D5A87A66F30731F2F2478A34BCC61A3D710D8DAF646403657AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295448, "uuid": "235702cf-ceb8-4a61-922d-05a0cda3a904", "value": "1536:JKESN76uqQn1nUEuIcQo6B6snlZt+nyNWq5TOoEDhatami:J+DVCWoQVHQyNl/Wmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295448, "uuid": "7b7a0e94-6c98-48fb-9aef-de375d22fb5c", "value": 91596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295448, "uuid": "8fc1ac12-2f66-40e7-9149-081a9d4db011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295448, "uuid": "284a1f4f-c650-42a4-84c3-f7a535c3f3ab", "value": "goon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f3dda6-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767228636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228636, "uuid": "0f78008d-a416-4717-abb8-541c36ab373b", "comment": "Malware payload (ConnectWise)", "value": "4df8c2728d7273c91e990f45354b923e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228636, "uuid": "4a8295d5-d8b0-4178-9801-f16a30b95d5f", "comment": "Malware payload (ConnectWise)", "value": "cdb28ec4d453c52e96faf710163c4d792ea3bce7583428c6c15daea470a18884", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228636, "uuid": "c563f9af-640d-4c03-ba2f-7a28766adba9", "comment": "Malware payload (ConnectWise)", "value": "9da487811150ec21aa20c41e0ef7a1464714ebe2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228636, "uuid": "224a58bb-a173-42f8-89f6-0587c888b863", "comment": "Malware payload (ConnectWise)", "value": "8fb135a07c49419709e0161838d246ce9671702df7683d0f4b36a4bdc34829d725c4e830abe8ca1999a2a304f928af78", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228636, "uuid": "a2af4cfe-3db7-49b6-854a-28bccda34d64", "value": "T19907225173E949B5E0BB4B38ED7A86522A34BC049B15C6AF17A4792E1D32FC08E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228636, "uuid": "929b4345-3f93-422c-96b6-54fc0c8dcfa2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228636, "uuid": "3a257f8b-473d-4356-9ff3-e743da9b7b1c", "value": "196608:51EfefPkIKaLNkbg9i4QnKaLNkbgyKaLNkbgsKaLNkbgfKaLNkbgzKaLNkbgl:55Wg9iH/WgEWgCWg3WgLWgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228636, "uuid": "1f8e302f-e72d-4a93-811f-ee89f49579fa", "value": 17000504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228636, "uuid": "e39f4832-d204-4cb4-bbb6-41126cb29568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228636, "uuid": "4fbd62ab-d34a-428a-8e8f-68bcd1908103", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b57a43-e742-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293465, "uuid": "92488c8e-db0f-4cc9-b888-4f37db9bd715", "comment": "Malware payload (Mirai)", "value": "3987003612b410508e007600d4fb9273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293465, "uuid": "95398f5f-1ede-48fe-b801-01ca0c679cf0", "comment": "Malware payload (Mirai)", "value": "ceb4e54bb11ea4cf5882f4bb7c6c0468fdc3c79fd9b541079f87230b2a21509b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293465, "uuid": "bd73c766-c7f2-446a-8de7-5a54fc54a205", "comment": "Malware payload (Mirai)", "value": "ec36cf485f56d4eda36c7f071bd1826a1b1cf661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293465, "uuid": "f22ad8df-6172-4e7a-a602-ea39f865c68b", "comment": "Malware payload (Mirai)", "value": "1108b19a05e73da93787935fb9a1cfea8bd2a6d9529159438c469630553d04b4bdae8b84adf414f891cf6e2a8e86331a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293465, "uuid": "6ada75cd-90a8-440e-b69f-a0bc99f65996", "value": "T13E936C02B7C0CCFDD49AD23856AF6275C822F46D1231725BA7D4FE166C8DE113B2E2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293465, "uuid": "013d8db8-053d-4727-9545-dfa10bf39e66", "value": "1536:EuBpCPyFK4o8NWuvULAwwqMluI1AVnDxeVCxTLhNSRys:90yA8Q2wwqpI1AVnDICxT3S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293465, "uuid": "f42d1dba-b91e-44f3-b120-095969ab4ac0", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293465, "uuid": "f2297bb3-d2ca-4d42-85a8-efee544034f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293465, "uuid": "070bc26a-f8c7-4a0a-9838-f60de2493fa0", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2e1e91-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270662, "uuid": "9c08cd68-d8f0-4d97-af1d-abdb83b2de3b", "comment": "Malware payload (Mirai)", "value": "1c64a460dc6c0e090d33d0cd052e4548", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270662, "uuid": "c34ed38d-644c-4fa7-9f8b-d0f467e4ed03", "comment": "Malware payload (Mirai)", "value": "ced51432bd57c6f15ebaf2dcb159e353b2b1579b321e500e8a675390f5caa5b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270662, "uuid": "6cce91d6-2bed-40e4-b91e-67094c66232c", "comment": "Malware payload (Mirai)", "value": "edc7e939ea6243babf15bdc7412ba5d4e1584d9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270662, "uuid": "bca3dc29-f39b-419f-af12-0e3d3a06545e", "comment": "Malware payload (Mirai)", "value": "cdf089e628dd8db23b166914c5cca8867e9d3857dbcccf3a791c5a99e94a6a1bb9d59ceb6c17e63c8bd4a8dfe9af5bb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270662, "uuid": "b24694d4-315d-4c75-acfe-44c19e363a8d", "value": "T1B511EFE541B64E16C1A9CDCC38B988385089D5C6ACA3CFCCDC7C497A1EC7D6D7106E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270662, "uuid": "281560e9-d838-45b2-9780-d1e1a89e1a6d", "value": "12:dUMtcUDdcdUeNUzNI3lTcUA0Kl2mUcUN6hUXRncUGFG30cUyMUBzUBBwUNTd4A:dtpcdWNI1ZKlm6CzHWvRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270662, "uuid": "fa56adc1-8b0c-48f7-8110-2fc7f30f6fb1", "value": 975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270662, "uuid": "5f11a52d-e112-484a-9d80-e07e1cfbda97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270662, "uuid": "adbe9576-a289-4829-a5c6-75355c8d8ace", "value": "x86.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9225f49c-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767225924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225924, "uuid": "13ab9f23-836b-4186-bedf-520705d556f3", "comment": "Malware payload (Mirai)", "value": "79ca8c7cb1d24e5b8b46c70dd37ebe26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225924, "uuid": "f1198f25-4176-4331-b9a8-f73d06107e4b", "comment": "Malware payload (Mirai)", "value": "cee008ce046dcef077b4057f0ab3ba3d4b6e972530ee5649d486681df7432a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225924, "uuid": "4034ec05-a258-499d-be03-1bea225d8f8f", "comment": "Malware payload (Mirai)", "value": "7adfb15a72956eeffddad51048eb7f3e5e18861b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767225924, "uuid": "e8ee4185-e0e4-4f98-9b8f-39b5cdfd25a6", "comment": "Malware payload (Mirai)", "value": "4e4db3579a393b87b8814a394c5e33b707ba10c4d19570c58a19103e3c92645a780bccccee9970236454e3b966d8f37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225924, "uuid": "8292b71d-59dd-4e1e-933e-29458cfebfec", "value": "T10AA3950D7E258F7DFBAD863447B78B219258339A3AE1C684D05CE9021EB024E745FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225924, "uuid": "4ae0492a-a245-4a55-8467-f9c5b1259d50", "value": "1536:0NpTUyaccudSFAnFQDSVRlH1MwTtnJ3GBTOdcJERnjNJv6AYVu4u9Om:cU7LudSWFQDSV2wRn5fRnjNJv6AwNxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767225924, "uuid": "40cb9d9d-51ce-4b12-8aad-5f4bea88f42b", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767225924, "uuid": "676fb6bd-4a59-478e-a0ed-152fb5154e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767225924, "uuid": "e202136b-bdd5-4d1a-b88d-299a440ef860", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e789ae39-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253125, "uuid": "77e7cf95-8612-46ca-acf1-b367c1076261", "comment": "Malware payload (Mirai)", "value": "3d82fb1af5a0f6248357af24480eb737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253125, "uuid": "20cc25b0-66a7-409c-b0c5-bd203f09f77e", "comment": "Malware payload (Mirai)", "value": "d11cddcf6ecfc0424f059773eb08e2620e262ceb46fc4fc360f12b62f4e13a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253125, "uuid": "088f8fa7-cba7-4509-8060-a67bcafee980", "comment": "Malware payload (Mirai)", "value": "c4a656c6c90bf7900e1c8df4b6d69c578f9d10e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253125, "uuid": "d29e6f01-0379-4af9-ba09-063b24970d7e", "comment": "Malware payload (Mirai)", "value": "5cbb2294572b695b0d9e58865e725622b22af6871852143a72e36137b8338c110478272c75d5921cf9122ef9ce39aede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253125, "uuid": "402f3c6e-15b7-4729-88c3-4684e0bc65dc", "value": "T170C45C59F8809F91CAD529B6F65D929C33030B79C3EB720799245B343BD78AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253125, "uuid": "8e195142-ea20-4d3a-b999-aebcf78d9c7d", "value": "6144:WoMtdh4vKX64/392r/UNXDVbo3ZAvGjJ4oP7vaVmrBJCEEbjbxgkgpZ6mvy0:WoM4v9bYoJjjzCEEvZgpZ6mvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253125, "uuid": "1c83bce2-070d-4643-9086-a0e7ff2351c1", "value": 553740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253125, "uuid": "d2cfda14-d92b-4a5a-af32-82cb8211971f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253125, "uuid": "7a89d175-0688-48d4-9daa-bd00e6278231", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb93770-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227769, "uuid": "34fee933-74a6-4a5f-a779-fe074f46734d", "comment": "Malware payload (Mirai)", "value": "b166f736b6711c9122abe3296bb062ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227769, "uuid": "009d8885-17a5-4c96-a2f1-e622fc976e07", "comment": "Malware payload (Mirai)", "value": "d176f60386df26cda58bb6964294361113a712e032515f4f970248b82b7b102f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227769, "uuid": "e2b67d2c-ea71-4d7e-9133-817c1641578d", "comment": "Malware payload (Mirai)", "value": "5b16f36721cd5e1092f215665fc7be622ae36493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227769, "uuid": "0b603b59-fca8-40f7-9b9f-310b1eb1eeb9", "comment": "Malware payload (Mirai)", "value": "db7f1eeb338ab1e0e1219b87a9fc7bb0b0a750e24ce8355165d87289481f1f7c5fffb66ea09bb9040ec494e28c0a7d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227769, "uuid": "c9a32496-99b4-4144-91d3-d3fe00160ce5", "value": "T1EAA37CC3DA53E8B1D8321075122BE7628A36E13220329D0FE7B52F35EDA5740DB563AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227769, "uuid": "06264cbf-2ff8-402a-b9fa-d645f50cc04c", "value": "3072:JgUgxxkTZzCCtPuTgSsP2LwGhYILS7SlfRv0:/g8lzXGgSsPILJr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227769, "uuid": "1bcd2119-96c3-4c29-982a-a4baba0c434e", "value": 104176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227769, "uuid": "29866d30-c8b1-49e6-9ba0-3f4fb680d465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227769, "uuid": "d537bc10-ec7c-4805-9528-765c7f6d3a27", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fce9cb-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297796, "uuid": "89fcbe3f-20e8-48b0-8fae-35378a87e239", "comment": "Malware payload", "value": "4dc9cdd138eed9808d95fa6c4b92cf48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297796, "uuid": "46467a09-1ef6-4d8e-90b2-deee478dc283", "comment": "Malware payload", "value": "d1c5f3c05e3ad76ce2c9825e340160d8143f9a908525ba2eb9c741c8e34e9d0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297796, "uuid": "04eca744-840c-4637-a7dc-d3ee9d3390d3", "comment": "Malware payload", "value": "eb3232e8532077097af27b0e45e37d5ac8ba6cb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297796, "uuid": "b05d7207-c229-4a1b-ac11-69182d882ba8", "comment": "Malware payload", "value": "5acdd380da559b619c0942602d77ff79897dcfd9a3fa9502f93639ac15cadb7b0b7a85ff525f6e52d199e4486a313cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297796, "uuid": "01b75ea1-ac75-4522-897c-e35262bc38bd", "value": "T110633C22BE754D1BC5C4A47661F38736F2F6878624AC991E3EA10E8CBF6464032877F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297796, "uuid": "9b46d5f5-9e3d-4f9e-a748-6e8e2dce28d0", "value": "1536:uNzP4A8a5TuUQh2Y3WqFBtycYW55xFt9s:PA/5TUotoBMcYwxRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297796, "uuid": "28cc4a09-e2ce-4857-b259-3ec4ecaf4bb1", "value": 68816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297796, "uuid": "2b042264-89b2-40f7-80c3-0bf247919ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297796, "uuid": "80dba56d-86fb-429d-a25b-4e868a488811", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2aef5ea-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226086, "uuid": "3c18d539-0ef0-433e-94ab-aa1b04762447", "comment": "Malware payload (Mirai)", "value": "72538eb88b56e10efbda7827543d0aff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226086, "uuid": "783fea2c-7ecc-4e9d-b217-69731530e178", "comment": "Malware payload (Mirai)", "value": "d23a22d0020e6fd36c5d7e6dc8b17c982789f69faa5c8747b47658a4d427a09f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226086, "uuid": "94b7abbe-8a26-4f9b-90e8-3e4347432a23", "comment": "Malware payload (Mirai)", "value": "c1e942c89eac1aedbe5db8e59d7637b2438c5c54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226086, "uuid": "7813dd2a-76d1-48b6-8061-e07f2fee263e", "comment": "Malware payload (Mirai)", "value": "fdf4b7393296a1780f94055674ecc2f81b06c5c25a7ab9ad455b125450c340c1a60c8c90c497b25da8b59a5347020d31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226086, "uuid": "c7e1ec79-cd01-485d-9953-6d305970a902", "value": "T1DD13FA89BC91D916CAC55577BF0E42DC372603E8E2EE73039E15AF66365F83B0A2B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226086, "uuid": "50ca06b0-4ed8-4e41-97c8-cf7c1ee6991d", "value": "384:BnpegF2gWwDkLvmAp4ewXUvGWdhZXv1A1irqQgmNMcqr/A4vALkMk6DuSVZoBz1K:Bn9Y+U5LK1irsmN7u/lBw2zixCgu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226086, "uuid": "feac78a1-b137-4019-af47-c8f3563c3fb0", "value": 42652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226086, "uuid": "6315863f-6a6e-4420-94d6-89b17f566d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226086, "uuid": "7b3f9357-40d9-4366-8c32-22ce379dfec7", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd44d14-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295441, "uuid": "0a7e3541-454c-4062-8176-b4b5991e5ba3", "comment": "Malware payload (Mirai)", "value": "f9099b5ef22f9cc7a2509e8098df4039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295441, "uuid": "ae26a2c5-7a0b-4256-aceb-e3e75eebaf86", "comment": "Malware payload (Mirai)", "value": "d33253c23018e902b6e6710f7a7e22b72bb55bdbeac3f8070c368cd92d914386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295441, "uuid": "75c9a443-14c0-408c-b95c-67c8b05703a1", "comment": "Malware payload (Mirai)", "value": "ec104925107cf43f30c6347aaea3b70aa0ff14d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295441, "uuid": "a54b0074-1667-4d50-863b-5516aa6524e0", "comment": "Malware payload (Mirai)", "value": "37b874fb571898074364f85303281f10771d6510b9f4c4a9a931465f78c517f46aa24d38fad5451bc94473e15d0cb41a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295441, "uuid": "f8c8b423-68bf-4ea4-a91c-87bc58c1ebed", "value": "T184834C42730C0A47D4671DB4363B57F1C3EA6AA021F8F689350EAB5996B1E329187FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295441, "uuid": "f3a75e6b-9921-48ca-8a58-75e8c38be62a", "value": "1536:SLEoq8JpqZ6OYZZcbp+LZWqK1aJSy3vhwqtVUw4COfkPwru9CvNwsh:Se86nYZqdu+1ZyUw4CObrBNjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295441, "uuid": "1b85afb8-301e-411b-a43b-a07325adf1be", "value": 84280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295441, "uuid": "bfdd829e-ad71-4b24-9714-af44beefcc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295441, "uuid": "744513d0-c322-4946-8993-b2c2891b6996", "value": "goon.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ea1410-e74b-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767297388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297388, "uuid": "141dfe0f-ec5f-4128-abdb-925003f1c326", "comment": "Malware payload (QuasarRAT)", "value": "8f452784b2c3910c7652bd35b66d9cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297388, "uuid": "b931443b-1f1c-4210-8d8f-7520756a9e73", "comment": "Malware payload (QuasarRAT)", "value": "d40088a972032de51cfc946a3585fbad54fdf06b3ba1dd5423a48ba7723654ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297388, "uuid": "e7f9c8af-9fa6-493a-955f-a91189656917", "comment": "Malware payload (QuasarRAT)", "value": "fbd7b9e63f2ce14c6ce749386115f5a2e176eb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297388, "uuid": "a00dc9b6-dd31-4c02-ab99-1edfa54cdacd", "comment": "Malware payload (QuasarRAT)", "value": "07d1fdf249fe8131484da33d6c163848852e24ba5093fbba9d4da39a4154cf339ba7e09266d993dc26e316cf47ee34c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297388, "uuid": "4a15094a-4d9e-465e-aff9-8331edbc3286", "value": "T136E55A0477F85E62E56BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297388, "uuid": "7d9985b2-1a32-426c-adc9-4588503a2642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297388, "uuid": "018e0c6c-e46c-4cf1-a4cc-34bded6653bd", "value": "49152:rvyI22SsaNYfdPBldt698dBcjHj4mrmzZLoGdaTHHB72eh2NT:rvf22SsaNYfdPBldt6+dBcjHj4m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297388, "uuid": "99116b19-0f72-4003-b2eb-755b813080f1", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297388, "uuid": "ccc71ff6-ac10-4499-aebe-7c5283b25ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297388, "uuid": "c9d2d167-b552-4c05-a3bd-ee69f0d26958", "value": "cheat-upd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec3735d-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767280357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280357, "uuid": "472ad25e-4f1c-428a-8ded-537f8fdf15ab", "comment": "Malware payload (SalatStealer)", "value": "1078b46254cda9b42c28bf45cee49f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280357, "uuid": "d97a29ea-ca3e-4036-8284-3c42ccf48870", "comment": "Malware payload (SalatStealer)", "value": "d4d9ce300fc03b52c818fb8fdfdefc3dca882113dd5bd0c4f3b0719df32947dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280357, "uuid": "45ad7fd7-61f2-4fef-8939-0bb363217f51", "comment": "Malware payload (SalatStealer)", "value": "7d0125a1df637886e5318f0c7629c5b55d9e6625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280357, "uuid": "31d3a0bd-c685-4ac3-bde5-97c60fada639", "comment": "Malware payload (SalatStealer)", "value": "b0ee92f73f56078a43892c31251fb70869b84328ada96182e2be9af4f6010d5dd940c6666e66b17e9e8f045d1cb63285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280357, "uuid": "dffa71ac-cecc-4eff-8199-73d253dc8b1e", "value": "T144E533FB21A204C2DC2BCAF678101EFD860BE2569F61E5B700DBBB36B512DD69035857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280357, "uuid": "603564e8-3a93-45ef-a78c-8bae6f819cf6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280357, "uuid": "efd78770-62f4-4373-b008-ef6509bdc873", "value": "49152:6SeGokQlQlMW5a3YcZmXPyqSFxBzgDj9+RzME+H+NTXV1tAcTUc1gkeWZL6eNpk:7mwi4cZa5SDBzm9+RzKeJntAUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280357, "uuid": "11cfa449-b018-4c8c-bfd6-4f0a704813d2", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280357, "uuid": "23cdb176-455a-44f2-84fc-c8ba3a246d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280357, "uuid": "6e08c83e-1dae-4175-87dc-0834931a296f", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb6aa81-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228680, "uuid": "56e0c8d8-c16e-40df-9395-0991d4df4e37", "comment": "Malware payload (Mirai)", "value": "dc7fe605211e8e68780075da19589e32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228680, "uuid": "679cf72b-5c68-4166-b63a-fcf8f944236c", "comment": "Malware payload (Mirai)", "value": "d4dcde35b271442fd3f871bf5fab955d8c13c9fe3bde7fd0c5c386c03e09bf7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228680, "uuid": "f72eb8f5-4b00-48dc-9507-21308155bf6f", "comment": "Malware payload (Mirai)", "value": "75116b3138116f9977ac6998e88aaf4f63b008ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228680, "uuid": "74fcf517-4af9-472a-91e0-d0168b64b943", "comment": "Malware payload (Mirai)", "value": "8e33a7ff211a85627598d634a3ae007f1411ca00e69bd5fad2e74e8d7c9d6cea394e7d3752972c7f6733bf56d24d4921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228680, "uuid": "6e4b4e29-e373-4baf-b162-fbbd592ca3c8", "value": "T128635AC19647D4F5E82604713077EB73AAB2E43E0129EA93D399A931FC51B42E2673CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228680, "uuid": "88487a12-7856-4022-9c56-a3d9ede95bea", "value": "1536:HYGXf6GcIpd6hW2PtnO8jS1wuUMHtbAEHScSEK:4Of6GR6hWQjS+uUOt0CS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228680, "uuid": "f16a3b38-081c-4ca1-82d6-8793095c8143", "value": 68208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228680, "uuid": "68e19367-e333-4fbb-88cd-ee4ab04af0c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228680, "uuid": "10d02f08-82a8-4c32-839d-9e0473197c1f", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6050974-e729-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767282758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282758, "uuid": "76262747-0545-45fb-9c31-411829a018cb", "comment": "Malware payload (Stealc)", "value": "00368b92a82a64a0007b4ce826026e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282758, "uuid": "54010f8a-02c2-45a6-95ea-8a0fe7fc9c71", "comment": "Malware payload (Stealc)", "value": "d4f03566144f92e892121eaa5650d62298d5871c452b078738a4c0088cd0ccf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282758, "uuid": "fb3d1abf-c1c7-4eee-8e55-5e52de7b37b3", "comment": "Malware payload (Stealc)", "value": "3801c7e29204c00cff72aa6e2cc44f7143895228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282758, "uuid": "742f61be-260a-482d-b884-182e6b63297c", "comment": "Malware payload (Stealc)", "value": "bef660aae745ba6e0889c86b0587aa0b66d29accae7f9eaba02726cc07dec255ecdcefab2bea98392719fb5941c124d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282758, "uuid": "6826b823-66c7-44fc-87d0-4df65e89f8ab", "value": "T1DD663963FE944266C49BD17F9CB2414576B03C4C073026D72BA167650EBBBE0267BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282758, "uuid": "0f990741-b9eb-4a1d-8963-f4edcf06dd04", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282758, "uuid": "a2b6a172-6031-42f6-9be4-39c0c0be2caf", "value": "49152:1oF/w50myq8f0wKpmV9XXGyg100QidcmavGzChwH2lU97aH+wl2vsGTiMlBinQFn:1JL8BWz00GkuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282758, "uuid": "5514f727-492f-4c4e-9ee1-e73673d25993", "value": 6902408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282758, "uuid": "3ae28af5-649d-4da7-bf25-f395017825ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282758, "uuid": "4d35959e-da5c-43c7-934a-ec7c5be17e3d", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd48227-e73e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291494, "uuid": "3e30d39c-dfb6-4800-a048-a67c9ab21d35", "comment": "Malware payload (Mirai)", "value": "9ebccdacff6a2228ceb9c171dbe4b414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291494, "uuid": "4f471664-67f0-40c8-bf53-db4476a28082", "comment": "Malware payload (Mirai)", "value": "d53e88bf320e249c5b9cfe81e3bef2d3ee74506982b005d12b1310a485ccfda5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291494, "uuid": "3908d4ea-b4ad-4cc3-9a25-4012752af3b3", "comment": "Malware payload (Mirai)", "value": "f3869742d76a58c80bb6f51cb136e9e7be7bf5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291494, "uuid": "3119304c-e704-4e5a-82f7-359d34f9f7ce", "comment": "Malware payload (Mirai)", "value": "e574ae72a2a3903eb3a788a318d4bf5fcbe3ef5fe8f8c4f51f12049739f0b8a76721142c6725b576ddeea03ec0a358ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291494, "uuid": "5bf88767-68ad-453d-8159-4fd51f417c03", "value": "T151C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291494, "uuid": "8a457dff-6107-4d6c-8010-5d69682aa9b5", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy9w:VoRNjmj1VGFVrRiyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291494, "uuid": "95f52b79-5ac6-414e-974c-07e7092c6219", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291494, "uuid": "f9eed3a9-c4e2-4a4a-b617-a079adcd743a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291494, "uuid": "ce50d7f9-5618-45d1-96a9-1d777ed66f55", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a27d632-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252781, "uuid": "f06c2e8b-2352-4c28-ba3b-a91240fe7034", "comment": "Malware payload (SalatStealer)", "value": "11f829c6184e759264b2228ca9f8ef5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252781, "uuid": "d4ad319f-0c41-45e2-bc92-e95488d10304", "comment": "Malware payload (SalatStealer)", "value": "d588ebe6f9fa425a3e2183ec2b3b92618fa2510ae78bad65e26676da2b889186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252781, "uuid": "6ed68104-da22-487a-b380-ee30c7ffabe9", "comment": "Malware payload (SalatStealer)", "value": "44686aba46b248c6426e71d48d54c840d5c8f6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252781, "uuid": "df3a16a5-7203-4f22-8d95-1678139fddc7", "comment": "Malware payload (SalatStealer)", "value": "6c043347c18513386282174236f8de21dcd7230adb62bd4e01f3b73b68b2b04dae5d8f25ff00d6d55993ada3feb7d6d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252781, "uuid": "58466688-03d6-4706-b550-e63b64092aa4", "value": "T15AE53370E0589417D8D7FA73A8819C67EEB1AE31ACF505200910CB25A6EB0B7EB5DFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252781, "uuid": "507644f1-c9cd-4f42-b828-db1e4e599bf7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252781, "uuid": "df0a7e7d-d3e6-4dff-9af3-9b4aec5f00ba", "value": "49152:tyrBV4yga3onu9J2H/hXrF1qQlp6jRvzAZRzFQSLhEmVrmmAmpck2XYJ9:KY1ks82H/hXRgHUZbQSt3rmmAPXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252781, "uuid": "a2143711-74e4-4cd2-bade-7eea35c3024f", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252781, "uuid": "a705eb02-bf36-480c-b885-db79dd7bb8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252781, "uuid": "129fe3f5-1ad9-4e60-8690-793eb6b3839c", "value": "11f829c6184e759264b2228ca9f8ef5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1158a0ff-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767297434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297434, "uuid": "a227c470-1a42-4e59-82c8-86e4ecbf7909", "comment": "Malware payload (Mirai)", "value": "bb9f933a2e6071901dd9993ff3bfaf50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297434, "uuid": "863f9e44-4a41-4a7f-9578-59945971ce28", "comment": "Malware payload (Mirai)", "value": "d58a1987f0fa618b32f36a3c5d33d63081cb03da22ef0334c1a58df10bdd928c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297434, "uuid": "c4f55474-bfc4-475b-8972-045da7227b3e", "comment": "Malware payload (Mirai)", "value": "181e4a661d5c4b918a20f8cb1bf30cc0c40b1515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297434, "uuid": "5b311ea1-3023-4086-a7da-b757ca7e99b2", "comment": "Malware payload (Mirai)", "value": "96e1c2cd238bc3709e545a6d1a37650bc53cba2345ebea1151081d6d57e8d6fdffb6dea26ea96e8206d534494e3a4885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297434, "uuid": "cb4409e2-83af-4323-bc49-27f24ebc7a78", "value": "T11ED35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297434, "uuid": "ddd0e149-9346-4e23-b92d-2615c02294f1", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQK:yIRfe3xvvSrlvZZ7UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297434, "uuid": "8472cc89-9b24-4e13-b7a8-be9bec914db3", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297434, "uuid": "de5cdce8-ba3e-40bf-9996-08075f6acad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297434, "uuid": "e748b9cd-f802-4292-9ed0-157799d8b457", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84687a0-e75b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767304210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304210, "uuid": "b0203b9b-4bfb-45c4-9f03-e0c183401d2f", "comment": "Malware payload (Stealc)", "value": "271e2683f47956b21a631dace079adf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304210, "uuid": "11789d46-cc33-489f-a886-06f480cbc765", "comment": "Malware payload (Stealc)", "value": "d5cbae815c0ce005b7941c1a3279c06bcbf229ebbfe00d3face5ab8499fbede0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304210, "uuid": "1efa7e6e-555f-40bf-9160-53c308ac401f", "comment": "Malware payload (Stealc)", "value": "ba5035bcf39ff948da9dca68bc972497c5977a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304210, "uuid": "7eb9cce3-fdb8-49f5-8c32-0b2d55b6681f", "comment": "Malware payload (Stealc)", "value": "a40024b130dba6d5c9a448b25f6004c9e7bef9dffd988418fd865b0850f55770a8fd6875fc7e4ceb34cec036a5f4b012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304210, "uuid": "af8d8855-76ed-4787-9369-7e54b5732c7a", "value": "T14C95BF0553E141FCD4FA8538CA759662EFB2780617348ACF65B0D20B2EB3AD07E797A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304210, "uuid": "e6cbeb1b-1cb4-49ae-ac41-9161436b928b", "value": "626e971fdca3f41443dd4ab7089c5b94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304210, "uuid": "aeb8de9a-6a91-4669-afbc-8fab3ba67623", "value": "49152:QGtlqVPUjaU0NVV4h74I+YOM+ZOzsY4+p2Inc1pC:YVy4fCKr1pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304210, "uuid": "59cb6b7c-0e43-4f62-a1a6-c64edb4b5c51", "value": 1945344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304210, "uuid": "cec008ca-0775-4475-bb68-44f56e23b4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304210, "uuid": "abd7bfd3-9b42-47d8-bc7e-b2a1e5944a11", "value": "271e2683f47956b21a631dace079adf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca351afa-e6d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767247922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247922, "uuid": "61fbc9f6-e9a6-4d98-ab02-8b2b238425a4", "comment": "Malware payload", "value": "3decf088f5421aa99c5b1a092a17a9ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247922, "uuid": "11ac2db3-3084-474a-9762-db627a363cab", "comment": "Malware payload", "value": "d6782b7c6a4f1929f871a725a75aca764d091bab3fa9e82efb95612acdc5b14c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247922, "uuid": "7f7426ad-fc71-47f0-8161-f00b6391dd20", "comment": "Malware payload", "value": "89c960ef0dd282daf0fb692a028d37f897ac36ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767247922, "uuid": "73b85db3-289e-4df9-9777-3ea321254806", "comment": "Malware payload", "value": "e1fac0cd8a422d1ee4782029166439a07ba0f0234cae352cf6f41d4e2c8147f619786ebd5ff419b057487f2683cae94b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247922, "uuid": "44e73f7e-9921-4b93-996e-87ca5686dcbb", "value": "T18E1154DA01D093014CACEE843559452DE558BBD078A09FBDE8CC84B9FAD8A1B7265FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247922, "uuid": "22818563-cd23-4941-81a7-869512ea6dda", "value": "24:O+LXzA5wNIKiX5RK0gyU5Rd4WFQ5cMdVaPm8klUIxUJ6dGgUu7dMH9:5k5VP0vEWa2+VlDUU9UeMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767247922, "uuid": "71fb504a-d4ae-4997-a5e0-98f382897327", "value": 1106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767247922, "uuid": "4886a1ca-b4b7-488d-a33c-84957118e660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767247922, "uuid": "7f8e3be7-789d-4b47-b693-4f1ce594606f", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0debf4f7-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272088, "uuid": "c2b44f19-d90c-454d-9e53-003c5f253704", "comment": "Malware payload (Mirai)", "value": "ee4189084e91f163331c1f67ab3307cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272088, "uuid": "5cfcf6df-c95b-4eae-b312-f7d739c925a4", "comment": "Malware payload (Mirai)", "value": "d6bae315b105d0bc05802596076e7fda43fae2b8b2ef0380d26076058917173b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272088, "uuid": "bec0587a-870d-4d38-a1c0-4b241ef76f6c", "comment": "Malware payload (Mirai)", "value": "52b947c4684960cf7c9e0cef9873b84d73081b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272088, "uuid": "7806ea60-5a38-4fe4-8b7a-eda17f80186b", "comment": "Malware payload (Mirai)", "value": "5eb2be2901697bf4419714d6351b8c06e841eac85d59026b5d9c871782afcfec531ba0a3db02358b5bc4ae173abe9ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272088, "uuid": "e0c508d4-080f-405b-8849-e52d3886872b", "value": "T1D2C3123ED5341227E423F4ED45ABC6228A5766FFFD0C8E63951F5A824CEA9097240BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272088, "uuid": "7dc8c2de-fbfa-4064-bc3c-81125b158736", "value": "3072:W1y0/ktL/sj+CpW+U92Sw9GtLa3ekR4ORtLsZ8F6/zrAFJ2cndL48E6:Uy0/u/f/32SwsAfNsEn2cndLE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272088, "uuid": "3e071dfb-5d40-4add-94e2-f1fb56da67a6", "value": 118216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272088, "uuid": "57a31c6d-cdd5-419c-af06-9bd9ff130e78", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272088, "uuid": "72d5297f-af83-4c41-afeb-873dcad9a0eb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb90ba7-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254748, "uuid": "558d1c20-7a45-422d-be4d-738108f661a9", "comment": "Malware payload (Mirai)", "value": "c9535029b96ffe637232caeda8b316ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254748, "uuid": "8df37c68-8aca-4870-8d80-e7d01208c1ee", "comment": "Malware payload (Mirai)", "value": "d76564ccae6da46add86edce0bb04f496cd1314627037762b9af384f8b559d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254748, "uuid": "2cc3e9f0-0515-414e-a26d-5646c910a4d2", "comment": "Malware payload (Mirai)", "value": "9b3dc89809236b966da41ae94d05b8916cbab0f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254748, "uuid": "e47c890e-04b7-4c47-87b3-f0d4579b5bdf", "comment": "Malware payload (Mirai)", "value": "260787ff2a776061ab2615d8f9cf490c2a10fe41e4c53b47225f95ffa3593abe03814a9c6eafd97f01e2ddd6c37677ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254748, "uuid": "818d2958-35ed-4f1c-9984-6162aa78cfef", "value": "T1BEC3BE97F78B25A1CC6246F007C77B8E2E6361019E6BE9E76C1E667B09790DB19073C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254748, "uuid": "cb54da0e-8205-4b43-8501-b61b60d9fcf4", "value": "1536:7FnZYTO6EtVQgh3RXighMa/WqqnmQ2IQWUpBTJChxZJqcg8z0/LW4:7hZgutmonhM6tDIQWeTJCKcg8z0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254748, "uuid": "b5bf8c82-f98c-4054-b371-cf60313870fd", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254748, "uuid": "0310552c-4771-43a1-87db-bb1ce1e99e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254748, "uuid": "10a6ef35-6d50-4b03-b79a-634a09804fa0", "value": "m9x7k2v8b3.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c01e6d1-e73e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291653, "uuid": "8ba64381-f008-4310-b298-f2297d52cede", "comment": "Malware payload (Mirai)", "value": "cab6d92ceab497489193cd9155bd830f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291653, "uuid": "d9a6bc25-3c35-4062-8766-3df5e5ec6643", "comment": "Malware payload (Mirai)", "value": "d7babcacd498f635b8e07c53b837d0ec01f3f559fc1eb3ae5913db79e028990c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291653, "uuid": "8cc81585-bac8-4174-83e8-504b1686535f", "comment": "Malware payload (Mirai)", "value": "3dddaca90e9a45a1c3f59f8075df976b669ae564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291653, "uuid": "bfc1238f-cee6-4d78-adaf-9430fc1120f3", "comment": "Malware payload (Mirai)", "value": "3db4a2b9e4357765345a6e19e3d09a537cabae1bac7bf4bf21d55e539532ce0e84f48e248fa3d9bb518c81fd23522d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291653, "uuid": "2f859b99-0fc0-4986-a8a4-2d62ac47885d", "value": "T18134E70ABF614FF7E86FDC3712EA0B45218D980622A93FB63574E918F54E24B19D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291653, "uuid": "13541c2b-7f51-4a92-a71f-299a9ebb15ae", "value": "3072:G9KxZzThCINs2nDou+Dmb4QuTthDOZgOd6kBUqm8DMplH29FMJOdbq/:G9YzNCIyaDou+Dmb4QuuRg8DMpc9Fz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291653, "uuid": "b1306788-0569-478a-bfae-9fee2e537fe7", "value": 244836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291653, "uuid": "dc737e0a-8c53-4132-bbb5-121b857913e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291653, "uuid": "044fb9d9-3da0-4498-8590-07590e1f6f56", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a45142-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292185, "uuid": "a488ba2f-cc07-4ae2-bf6d-e3c109226e3e", "comment": "Malware payload (Mirai)", "value": "73cb38f00afc39c01fea8bef03b1cc6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292185, "uuid": "d9770d22-aa0f-452e-a615-6f84461b1a89", "comment": "Malware payload (Mirai)", "value": "d7f4b6f4d7b7a82ad45a5db4d9d509f330c6a2cafa902eaf88139f1268875b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292185, "uuid": "22603822-a431-4f32-9a5c-aac3b4666c88", "comment": "Malware payload (Mirai)", "value": "f590e4630cb05937f2818e7d038cec1d262edf7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292185, "uuid": "c964b9de-dfbd-424e-b3d8-12ca8bd055a2", "comment": "Malware payload (Mirai)", "value": "9dd4c3f9896be0ca26d254af6083d53f3888e533580398107f2d5898cb6cc501d063953a157e3a78e2ba38804906fad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292185, "uuid": "a533ffb0-e765-469d-bd02-8a3c18330283", "value": "T130730272E14049C1DCB46FBF669D9585F4508F74DB3BB9D02230D2A8E6A3713593E8C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292185, "uuid": "2c11bb8e-2bdc-41a0-ae36-c1f87869fcea", "value": "1536:5s/gYb7rqHEAzIxt1zkMQE651ApKkW6lpmrfv6eEJcBbad26ZNilJleLA:5sIYfrqHEAFzhyXLOJmToJILA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292185, "uuid": "0cffe214-8c32-4554-8bfc-e4f14250aea9", "value": 75156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292185, "uuid": "4b7b3c04-54e4-4181-b20d-7404daff08f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292185, "uuid": "31a60b76-5ac0-4b42-a09a-0c863de0aa59", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf49d84d-e6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253487, "uuid": "5d41e838-f244-4ac8-8a6e-d01cae49c9ed", "comment": "Malware payload (Mirai)", "value": "fb51a7b34c0ec6b8b6ef79fcd06af766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253487, "uuid": "739da92a-112a-4c7d-ac37-8436cd1e9042", "comment": "Malware payload (Mirai)", "value": "d7f6bb3a042143e4d41ec4177016affc949c76c73c4b349ca25fbd367fa662a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253487, "uuid": "ef924696-fffc-40ad-bddf-d0cf87522ba5", "comment": "Malware payload (Mirai)", "value": "f43fc37911c9a54cbce5ce6599d1e449fd2b05e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253487, "uuid": "b1fe5f61-a5c5-4596-88d1-976cae76faa1", "comment": "Malware payload (Mirai)", "value": "d1513cca1d42664a6391d643dbb40f41c89b3068f949f2724dfc3d533f29447a47b06ddc81025038a82fceded6658b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253487, "uuid": "9d2db49d-02b9-4b1b-ab43-b7597b432c7b", "value": "T1308318DBB401DD7DF80ED77B4453490AB670A39119830F3B6397BA67ED321A84866F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253487, "uuid": "90da961b-5af8-44ea-ba39-183f588b7d03", "value": "1536:pfrfaRrMYSLOeZq3LBv48L88+UwizzBfHz++TXb7VZLpchc1SLJOe:pfrfaRoYKUp48LYUjfT+wfuhc0Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253487, "uuid": "595fa687-57f7-4e39-9577-45dc4d74137b", "value": 82364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253487, "uuid": "6261d4da-6903-4a85-8a1f-f90c920fd2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253487, "uuid": "b8628c9b-29f1-4711-af1e-c7c59ca8f0c3", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71868fa-e716-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767274626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274626, "uuid": "502b3595-d6cd-4bb4-882d-ab8fcaa35155", "comment": "Malware payload (Vidar)", "value": "1e5a31d18fb657cf54bdd50968070ab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274626, "uuid": "51a4da50-6823-4255-bf9a-7dfa6a4868b8", "comment": "Malware payload (Vidar)", "value": "d88d47e27e3272bf47f0e8c9f074471fb0c7131a4c327ef11f5705be84540a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274626, "uuid": "2587393e-3903-4cf0-86eb-d7305403abc6", "comment": "Malware payload (Vidar)", "value": "a4543632246cec9f5df5a7039f0ec6f51a2425eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767274626, "uuid": "6d15a57d-4762-4ae0-a748-239e92e350d6", "comment": "Malware payload (Vidar)", "value": "d0f902cef04400db6498fafdd1418be02d2c49785f9ff143318e3c76104b25ab8d3410b5763347a421b5027447deba3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274626, "uuid": "5d2790d9-38c3-46fd-80f8-8556d44a274e", "value": "T12B361943BE406158C66FE234EDB4A1657330B444533413E7EBA75BB04DEAAC81E7BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274626, "uuid": "22de61f7-fc5b-4a7d-9924-41a57c787285", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274626, "uuid": "4dad82e4-e4f9-4f9c-962a-df97c8fbb37c", "value": "49152:Baq3L/TKEvrb/TgvO90dL3BmAFd4A64nsfJvHd6pnUZK1p5iFo1osf4K1x4EdJgF:8qVIDJ3yKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767274626, "uuid": "c742ef73-3e90-4ae5-bad4-133985d3a649", "value": 5106304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767274626, "uuid": "5b6eb642-89d8-4234-b627-576314e26563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767274626, "uuid": "7aa321af-9e34-4a71-9f93-c3082de237dd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626413b9-e726-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767281249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281249, "uuid": "39b0b381-49c7-4839-921e-c1046103a705", "comment": "Malware payload (GCleaner)", "value": "463922fd03d957df0a832fe11ec2e8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281249, "uuid": "e65a87ce-967a-4be3-9e12-2df7bd44ba2a", "comment": "Malware payload (GCleaner)", "value": "d8ffcd399b76a0bc78226b7796b8ceb87d4cf2980fcb5ec4c1e7ffa026d8adb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281249, "uuid": "e1b53dc3-a9d3-43a5-a841-bbb95e48f490", "comment": "Malware payload (GCleaner)", "value": "9d2073b933dbc2f717dc2921f82800d013c7ee96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281249, "uuid": "cc37ebde-28c3-4e3f-b075-bd1b41900398", "comment": "Malware payload (GCleaner)", "value": "cd9400f258d866a290d6080b3e45eb1f413d1c1468787a24ec47b7384abc19227798d1eafa0222f16ff429d5342f6366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281249, "uuid": "0f4d8dd5-6090-4a31-bcbc-290528d5afc2", "value": "T14C26D07EF1E07892F162DD348E4E49F09CE2A900E26F0D292D593557FAEF6850B93706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281249, "uuid": "16561ba8-3bcc-4560-87ad-e5d1db6a596d", "value": "bc60b4794cae268523730c857221d993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281249, "uuid": "58db2e06-f51a-419a-896b-b045a135b535", "value": "49152:gyrw0YEcaOVRXFfDJ3Znvjx0nwX1Wd0wLiBIn4Ql5LZ+VDpYcqkDYVUlSc9yWBVo:gyrwf7XFLJZvjxMwbkDntln6nOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281249, "uuid": "9c3ed74e-dbdd-4618-bc80-67c9b0a9f4b0", "value": 4594960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281249, "uuid": "858dee35-59a8-4d88-989a-2f30a09e1c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281249, "uuid": "006dd216-5721-4915-8cc9-62e98bcce610", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2c2ee1-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227551, "uuid": "2e08c89a-3902-4413-9ee3-85c9893735e8", "comment": "Malware payload (Mirai)", "value": "d84c116bc7f078ec1d1ce753c85a56b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227551, "uuid": "6827cd5b-427e-4348-b099-444671031986", "comment": "Malware payload (Mirai)", "value": "d9107a1067d5c8db6f1dc67b0d37855dbac36966b3acd4efc682d054e66e397f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227551, "uuid": "a4562a5a-af10-4041-a791-ca16fed846ee", "comment": "Malware payload (Mirai)", "value": "48f0078a79f45ab6525e9ee2bc20300616e1f540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227551, "uuid": "35e5610b-18de-474d-aa8d-b2256184c91a", "comment": "Malware payload (Mirai)", "value": "0645eb57473bc75f94f912fce72f1fc0f1ee9d0ab3e1b86bc3ee87af86be9479f189fd0262e3348884fa32aa54ea41c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227551, "uuid": "cee1e033-7713-4afd-bceb-0c3c81d95dd3", "value": "T192C35A63C8266F58D665D1B4F0748FB92F53998491830FBA29ABC2784483DCDF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227551, "uuid": "3f28082a-3cbf-45bd-bdc9-da61376097bd", "value": "1536:lGRSxHsMkoG+EFwhH9FxrN5CpYKuw6TeK0NmuEQWy1QDDvOvGP:lsMBWwh1Z5sfuF0NmQW4ij7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227551, "uuid": "062dae94-8e15-4842-b788-bd096c32e662", "value": 125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227551, "uuid": "41aa2295-68dd-47d5-9158-3f0da124439e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227551, "uuid": "f0afccc2-bc11-4187-900b-8cf61a698496", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd6013-e74e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767298569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298569, "uuid": "72e207f6-33b9-46a4-a540-c3fe254808ca", "comment": "Malware payload", "value": "949b5dbfab7da2049719de83955bf5b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298569, "uuid": "0a88f9aa-2e4b-4a6d-bd7e-6c2008e7d040", "comment": "Malware payload", "value": "d9605213d4e1e068a020d198111728fbc02f97f9fcfcccdc7e450bedb8e1f07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298569, "uuid": "23396934-6e5e-4e77-84e4-0bf327081ef1", "comment": "Malware payload", "value": "9cc315d049db4a452792d017ffee2e9d4f324513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767298569, "uuid": "d8f0634e-b1e1-47a4-ba43-f3f7fc10141c", "comment": "Malware payload", "value": "552e8ca5b24a80e54fb056e33070b5ecb060732546a214db2dce56ea8be0bd3d07f9c6b59558f465666a1dd2cbf0d085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298569, "uuid": "66ca6640-f3c4-4cc9-9eca-65ef7933a2ec", "value": "T1E6F533FC49BF6BD6E41BB76F3C0B5BA176C8823485DD1BB4222561079C32C532D809AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298569, "uuid": "c3c760d1-1c29-40e4-a534-f3c6013d832d", "value": "98304:5lu6PKdeuDnZOMMiIB9nSZbO4LtvCLUWOtSx:5luu8kMMr9SZbO4J9Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767298569, "uuid": "10e58bdc-2280-491d-accf-11a82ef86426", "value": 3551128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767298569, "uuid": "a914956e-d726-494e-b458-17afbee36efb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767298569, "uuid": "c0d77027-21db-4d85-9d5f-b9fa900249b1", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701c7ade-e723-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767279983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279983, "uuid": "950a61c1-3038-4372-a60c-d37f37035d19", "comment": "Malware payload (SalatStealer)", "value": "8dd6b932ac97c131476b45d6e6674a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279983, "uuid": "7f4beb63-36be-41e0-9c30-972826cfe894", "comment": "Malware payload (SalatStealer)", "value": "d9fa98d9cbdbf1921467863cbac699862a59cd63839a8cab0e26d9ee25567f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279983, "uuid": "9938847a-b809-4031-8464-f49b17de86e3", "comment": "Malware payload (SalatStealer)", "value": "3045478583db81da5515f4645960fc20aa850a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279983, "uuid": "5f1000a1-13dc-4fc7-b949-373d9e460019", "comment": "Malware payload (SalatStealer)", "value": "a025f4fda592a0204ce99702f4da3ac439e839a4d5f860856e368ffaa3c8f690905a922dfd4dadf0bc03fefdbab3c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279983, "uuid": "f0fbcc43-5650-4376-8b6f-7584e0be5842", "value": "T179C65B51FA8B54F6E9031831809BB23F23315E048B28DBDBFB547B6EFC776811966249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279983, "uuid": "34383d5e-5f74-4b48-aa82-8dc0d888ed29", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279983, "uuid": "a0584b67-527f-485f-aa8a-721a15e85a7c", "value": "49152:7y0jlpyuNJbGB+cdN+MbgjXuwEEA3VXnSCVyiOH2qYqnNcUu3PAxTDamvq1uv1Hi:GElYU8+HOLlfgf0Ld80qJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279983, "uuid": "c05c0f21-6fb9-4924-bd00-efb435061610", "value": 11656704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279983, "uuid": "5e24012e-7f07-4a59-a255-9d9043b9dd12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279983, "uuid": "05d56914-23c5-4fcf-bfd1-85c0b8277353", "value": "BLUMECRACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d098e6-e6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767252230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252230, "uuid": "fd699465-bfa0-4f9d-a0a7-b6916a298bf2", "comment": "Malware payload (Mirai)", "value": "907dbf8740d3ef74a297cceece82fdf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252230, "uuid": "8e9ce1b3-9476-42da-bb1f-db2d58fd4770", "comment": "Malware payload (Mirai)", "value": "daa0416d58fc8f5ed2c1b84c265d72c2324c5f870eac66f5a06a476d69498420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252230, "uuid": "7e407bfa-d7dc-4df5-ab0a-7752f9f3152c", "comment": "Malware payload (Mirai)", "value": "2d7fe0d00aca029913066a2c22fb322b29c6d3c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252230, "uuid": "a33eb5b2-99fc-4c3c-85cb-28a3a9b1bd30", "comment": "Malware payload (Mirai)", "value": "7bf993dc58b301648d687f90221b39d3e2ee42eea61c8a6f4251671264e880738745799ffa9c6f6983a12920da7ac45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252230, "uuid": "92d92799-c53e-4296-80c2-4397cda61285", "value": "T1CB735B32B9751E2BC4D1A8BA31F30725F2F2478A25ACCA1A7DA20D4DBF2564072537F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252230, "uuid": "28f0abd5-0c4b-4bfa-96b1-cdd173d2fd2d", "value": "1536:SeQS9DQtLXG3+9nmCBsWQltKoNNk5nV/o5sdtclz1X:hFMVtmCBWc8NUn9elpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252230, "uuid": "a791326a-ee5b-47d6-bf53-232a96f6093e", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252230, "uuid": "b1dc5565-9ae3-4c83-ae53-27b21012a604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252230, "uuid": "a050c6b1-b17f-4d02-a433-7b55dd5f29ad", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dd0e75-e735-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767287677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287677, "uuid": "e53846d4-2427-40fa-8156-e168ecd27e10", "comment": "Malware payload", "value": "56bec5a759f57ad097d08b35289bbd4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287677, "uuid": "32f80d6b-9f15-40d7-b69c-82bb1fcb7be0", "comment": "Malware payload", "value": "daed34ae60fb5cd68ba446c6a28c422db96c359b5918f29453cddef16a47bbe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287677, "uuid": "8aedfe03-b519-4079-a2e0-ca86bead563f", "comment": "Malware payload", "value": "3608c9b0a996fceaa2dd7d7594c61f4c016554e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767287677, "uuid": "5d7b4120-2ab1-440b-accb-81db80f7659c", "comment": "Malware payload", "value": "e531e2ae991e7c8962c83b9c5ed1560ff81b68d51230d42d98bd4c71bd91cf42d32e893462847fab2f05a7e28eca576c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287677, "uuid": "60fcd569-0c16-43c9-a52c-956498a31179", "value": "T1C804FA165F2D206CF5A2C2BAC26E5E45D377B8140B7297CF139D809A0FE728199FAF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287677, "uuid": "7cc9dace-8823-4f26-8ebb-7c65c9edfe14", "value": "ee6931434dabce038bd7a6b703e60c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287677, "uuid": "22c618bd-9df5-4ecf-8215-316a385f5b4a", "value": "1536:nBX7cR6cHrEMMSzlR5nGYJ+ZISczk5Ps9u6LR:nBrcR6cHrjMSzlRF3yISczk5E9u6LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767287677, "uuid": "78ae0f74-3d52-4f97-ad51-5efb6b6f25a4", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767287677, "uuid": "1e457a6d-7649-4789-a9d2-6a164cdc5433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767287677, "uuid": "f548e3c3-f276-45bb-aa91-a73704d89754", "value": "VPB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740fb09f-e73f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292016, "uuid": "aa62fa16-64ee-49bb-a423-c3818c5007a4", "comment": "Malware payload (Mirai)", "value": "cb02098a0c1caafb362baa26a1d828cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292016, "uuid": "290598f5-8767-41de-a529-f2c9e3365e38", "comment": "Malware payload (Mirai)", "value": "daff9a10a8f5a23aa1c66bdbf105b86f971ccf90a7adfdd2d8d6f8b54845e7f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292016, "uuid": "8bdc753a-3c08-4a53-bbfd-7738bff3763f", "comment": "Malware payload (Mirai)", "value": "21f6b8de176d043398d37bcb829d09576b4bb293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292016, "uuid": "13da1987-78d5-4690-b6f4-08698ddca985", "comment": "Malware payload (Mirai)", "value": "a657133976f74f3e5aa5591340225e1a919eeb821e30b65a456d84afee29c9d8ff4b27c1908806c380c3598b2baad697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292016, "uuid": "28b4e4bb-de36-4bf7-89f7-a93fa3c7e428", "value": "T16163F11BF2849658C65841343EFE9D9A18C0D48D822BD05F9938B4AF9E53D6CBD3E2C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292016, "uuid": "2a6f98bf-49c4-41c4-a539-17be150519a9", "value": "1536:cJWtr1Qb3Fgp+Od93e1Ltb3wDAOr2rbYmOFPc75pXpnouy8Hyi:cJuq7CpEZb3wDVarbjOu75ppoutt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292016, "uuid": "e4360508-f3e0-49ca-8c73-5149e0a06b8b", "value": 68504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292016, "uuid": "63533740-640a-4466-a978-84f5b80de061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292016, "uuid": "95d1436a-116b-45e8-aeee-6ab5c29b83e6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4903db53-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227949, "uuid": "b39021bc-008b-4483-8ee8-d96dae10d33f", "comment": "Malware payload (Mirai)", "value": "89d253f09520729b47cd596e27c30400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227949, "uuid": "431c013d-2028-4b6a-a15f-fac3917dc68e", "comment": "Malware payload (Mirai)", "value": "db5bbc0d4cc9380971a1fef1c4f0a218846f3e3a1773051507c90fd68f094164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227949, "uuid": "fcc9efb5-ca61-4c40-9649-cf01c1d059f2", "comment": "Malware payload (Mirai)", "value": "3504ba1cb105b9f9bfe42baf2d5704c2f07352d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227949, "uuid": "30c271a6-c7d6-4913-80b6-5827b3525d04", "comment": "Malware payload (Mirai)", "value": "33065c4a91d8e039e074998b51205109aa79849c159a1407fbcd36750a15a6b9cb37c4864dc7b10d3fc2a4486d75ceb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227949, "uuid": "556f8109-8bbf-47d3-9855-08588b96739e", "value": "T1D453B516BF250FB7EC5BCD370AB9574534CDA40A21A93B393934D918F24B25B4AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227949, "uuid": "465fea2a-81a0-4de8-9291-d005ec0f3224", "value": "1536:u9tfkwYaPr37gNsbM52mQhEsCk3SvlRWuJ:uPoaPzVAW6WuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227949, "uuid": "4b428380-f225-4bb5-a461-3cebaf6f23db", "value": 64984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227949, "uuid": "228e1999-0d30-482b-9047-abd9e61834c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227949, "uuid": "71f7acd8-f729-4b4d-93de-454310ef9dac", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d7468f-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293096, "uuid": "b6cc4587-e101-4444-b9fa-78a30b3eebf2", "comment": "Malware payload (Mirai)", "value": "b08f74c5919e2bd426ce1aebbecf5a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293096, "uuid": "385377a7-3e35-4775-b8c3-e6490d7c9fb6", "comment": "Malware payload (Mirai)", "value": "dd466160fc0e5cd3e70e7bbb97993452d8e3fddb7aa91efc42cc7a244240ffc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293096, "uuid": "18d92fca-361b-4d70-86ab-c99e1e0116b3", "comment": "Malware payload (Mirai)", "value": "96459019723c537c76da6f4f2bb26be1469a8faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293096, "uuid": "0057700f-364a-4755-aa25-91d3fbac863b", "comment": "Malware payload (Mirai)", "value": "9813c2cddd39285ede2f77d0b38c81d17a13f9f7b612e771d86049023b25521fbf0c8bd9332f828f9b6694ba2855f668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293096, "uuid": "d6e116e3-9bf9-4bf1-8835-c3c4dc4c5947", "value": "T137936B13543C2A1AD1F0A47302774762B1EA265E0090E79FBE764E9FFF212C42E6B5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293096, "uuid": "bc2e5fcc-ded1-4242-97a5-71411e0ab7bc", "value": "1536:HKREcVL7BFSIeFB10NmdphO7bYp9+t1kWjkODOF1qcpfg5WIymQY2AUYci5hh1dL:HmpF6BLdpiYp9WOO6Hqeqhh1dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293096, "uuid": "f09b308b-dece-44ed-91a0-ac015b85d46b", "value": 94828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293096, "uuid": "5e1e0ab2-a6c8-487a-a99c-d172fa0a1878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293096, "uuid": "c95742fb-d3bb-4141-97e0-0900d7e823c5", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc8332d-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304572, "uuid": "9a211421-8e54-48d2-95c1-ce09a352bbfe", "comment": "Malware payload", "value": "7cfbeda56c598ae9130397ab3567189a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304572, "uuid": "9375a3ff-b581-45c9-a829-deec8f8c4253", "comment": "Malware payload", "value": "dd5b6e6d1b5901211029e81795ea59281c2aeeb1188e9738f7732c51e629fa43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304572, "uuid": "5ffc2d2a-0b71-4683-9648-b3dcc422adf9", "comment": "Malware payload", "value": "6df0b6a7f7996a237656f8c06c16ee1ec8d36387", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304572, "uuid": "431898c4-a835-4316-ac0d-e0cfe0b5829b", "comment": "Malware payload", "value": "37468b4275f7a8d760ab4aea8a7072141037da2de703ee7b810165368ea4e44227683a6ae0ead81fff63f98ebced09ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304572, "uuid": "4ec1f415-7d64-4736-b4b8-6ae47dd3553f", "value": "T10E5608C2ED91D24AC63D6D31EFD6EFDCE2272E315D885A4AD9C8F33E18B214580B55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304572, "uuid": "c97e4c23-b521-4e25-88c3-627df111aba3", "value": "49152:OsiSMdlj/pggvvfWo8256ZjXwSPUSgOiRPxzuxTQ/rGG40/EiMDrHHDt5Ea:OsiSMDlv+f8qXDPX7nDjEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304572, "uuid": "9606b2a9-0418-4443-bee7-af393f389672", "value": 6095032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304572, "uuid": "64d4188a-3d3a-4231-98bc-45504cba9eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304572, "uuid": "c077578c-5c72-4fb1-8a30-05c655600cde", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ac6028-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767226660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226660, "uuid": "2d193883-14f6-4d24-920a-b9d42452a199", "comment": "Malware payload", "value": "9cf3e4d0cd469fb647aa30cff8d8737f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226660, "uuid": "fe96a9c4-20f8-4bbe-b416-9fffb1574a87", "comment": "Malware payload", "value": "dd6cce2a66908f4b454b8125425e33cdd41f6cb11aef82f4fa6e155a59706c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226660, "uuid": "f3133531-28b4-417b-b6bd-25252b57583d", "comment": "Malware payload", "value": "b8c2c9b02a07415d194a33a777432afab69e2d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226660, "uuid": "d1f7895a-6cf3-403f-9305-84162c4e0eea", "comment": "Malware payload", "value": "6977a34815b762f55fdd7bb2aac01ea55a14030604df7ec3c6204856d25500f364157bfab527eb3ca91bfedb221ee2a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226660, "uuid": "692f1fb6-49d3-4c76-8616-131f6cc72b3d", "value": "T13FF312805010069CD74604BF7DB1A2F8B4DFFA5373A94611CBAB68305C6E5B3F74A58A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226660, "uuid": "0993a35b-47c5-4bfb-8daa-4d9c784d8d05", "value": "60004228f729e2d84428dd839f1ad497", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226660, "uuid": "48a5b1e5-d1db-4f64-8f62-9c02e97c70ca", "value": "3072:3b5u0yZzCl5CJZ16su2wDM/RZRf6ChLUtxZJstPpP2:3b5COl5CJVupDo7Rf1hLUtxWpP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226660, "uuid": "00dc89e5-f6e6-4875-8188-2c6a6e5ed28e", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226660, "uuid": "24e28a5f-f400-4eda-a623-86c375937c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226660, "uuid": "de84e2b8-8f6e-4f84-80f7-203c8e30038c", "value": "2025\u5e7412\u6708\u4efd\u7b2c2\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe3715-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Cybergate)", "timestamp": 1767272105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272105, "uuid": "8c5d2359-9ee0-45fd-a16c-2cbfd2a64504", "comment": "Malware payload (Cybergate)", "value": "1c0ef72f7b1e68f87b0a37954944f88d", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272105, "uuid": "4a7c6eea-0303-41b2-9d0b-dab22868f852", "comment": "Malware payload (Cybergate)", "value": "de12a7b95189ae2a83ea2a57212b49b4187885edb1c89b584121cf9c99525883", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272105, "uuid": "7514f426-d8a6-4ed9-b9ad-eb89c5a4a7a6", "comment": "Malware payload (Cybergate)", "value": "e0e4f9d6ef47e9f2bb0782d9321eff6aeb566f17", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272105, "uuid": "2da911d7-5194-4967-9cf7-cab30d89814f", "comment": "Malware payload (Cybergate)", "value": "a617d5239a24271f8004695002c453403d1d5940265b4e7a3819f7272198aa858fe77ca2f1b4ba8e8c2b84cb904f7d12", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272105, "uuid": "7d717575-9e54-4634-ae1f-d17afffb0dd4", "value": "T19BA5337871EE7883F791BE317637618BEBF46A21E8E6B38577C83F0A07A16042B55150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272105, "uuid": "75ff854e-ab1a-43dc-aa95-9efdf24f8e26", "value": "4d17be67c8d0394c5c1b8e725359ed89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272105, "uuid": "6b91d8a6-8992-4b33-8559-8825b24b6ed7", "value": "49152:wjLH/VugjDyXdTgVjgpwBMk4OonnR5eWyZY1j0tTxL1JICnAwLdc3I4GSLI7zLiM:IuMwogpwOpDnfVh01JICnAwC3XGQInL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272105, "uuid": "fffe57d0-f43a-4a5a-89e5-50ef084d02a9", "value": 2265746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272105, "uuid": "00ff12d2-4323-44a3-aa3f-44bb44e3b09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272105, "uuid": "fd6a1014-ed45-436a-8093-0f918992eb0e", "value": "1C0EF72F7B1E68F87B0A37954944F88D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b1f6cb-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767283001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283001, "uuid": "b0c7390f-b787-46a5-9b69-a56e760cc594", "comment": "Malware payload (Vidar)", "value": "cdc8c2be0e6dc1868b06e541ad3eff40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283001, "uuid": "01d8a7f6-e725-4467-a608-20941c3835af", "comment": "Malware payload (Vidar)", "value": "df50d963483924f1f1c4c6114951c5d943b8a4a6e4d23dfce55157a0c63f50c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283001, "uuid": "9bc0b1a3-4835-4e0c-8f98-c97c9171c991", "comment": "Malware payload (Vidar)", "value": "a39bc70f00474b5f70718b607212ddf3e9be3eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767283001, "uuid": "d4770f56-c4e2-445f-8bca-d8b4e762690d", "comment": "Malware payload (Vidar)", "value": "4dfe1859797bf7a0b4f5c14a0ac19a26b4a62e2a6b992cd4ec773b8e68c4fa9240c7ec0077fedd51fee0a819f3890c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283001, "uuid": "38a90ce5-b939-47fb-b89e-70b1e13bacd0", "value": "T1874601496166C4E7EA97597157060022E1733D378364AEFB87A4972EDE4FBC02A3C372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283001, "uuid": "c4b2f14a-4916-4a83-9d43-8ac7c61a47e1", "value": "cf044a6898eb338631b1a53e8634e95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283001, "uuid": "00b67357-737b-475b-a01d-df39daba9e8a", "value": "12288:8LHIYRXm0vOMP75AoEU8PYEd5XSRWlQUV6p+eUGaQt6HakIRDesas1:8bIYR5GpPt5IWlfKVjahdIRiu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767283001, "uuid": "c7d412b2-9628-446f-a3fd-e115fc5dc776", "value": 5612544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767283001, "uuid": "38ced7bd-62d1-4fc4-bdaf-cc9cafe0fbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767283001, "uuid": "ab45d8cb-b971-4f14-8388-00e61d42c03c", "value": "python311.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec9ae94-e74b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297242, "uuid": "878c87d8-fb8a-4e6c-86b9-afc91ee2e946", "comment": "Malware payload", "value": "5042f39e461b24d3c71e4115512796cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297242, "uuid": "516367e5-71c8-4978-97ac-8964bf77275a", "comment": "Malware payload", "value": "df6368c3e38fd3027439ce6033ca0d0d86cd04b02c4fac6ef89caafa620b5720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297242, "uuid": "d3196f50-c95b-4f77-91f8-ec38a30f5eea", "comment": "Malware payload", "value": "e2ae17d352b06971c880950b197d642eafd8b26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297242, "uuid": "82e1e434-3a7e-4fdc-9624-642ed32b6a42", "comment": "Malware payload", "value": "a5d9aeeb07cef40fcc58a09a1a773602a30fea5a4007f70a283c3bfb4163a30d84e17568a8ee478b91bf6fe2a01fbbcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297242, "uuid": "4502f9d4-e9a9-4ad8-908e-e50bb11182b9", "value": "T1B1058D8DEB87E4E1F26340F1025EDBF64634A12A4013F6F6EF452A6374727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297242, "uuid": "a75375d7-27c5-45b5-9191-cfbf8534742e", "value": "12288:WjKD+WgRh/7hADkQKXesz5+KOLqh2xBJFkhvApDFwvpfh5TPyMDxkAXaEBzb6QLu:B+Fh/7hYKX7YKXw7JFkhIXwxf3xkAXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297242, "uuid": "51aa1357-2118-4112-a5bb-c3fbd4aa8f1a", "value": 861080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297242, "uuid": "0dbe40ed-c4ff-4841-b147-567e67dc4d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297242, "uuid": "71a5475a-31a0-4eef-bf3c-a2eafd93a728", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9f0192-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292376, "uuid": "25a43947-5d80-498a-9c74-349d678961b7", "comment": "Malware payload (Mirai)", "value": "ebf6723867eac2a01692c16236c7df3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292376, "uuid": "2ab54499-667b-4253-ab82-9310657c3d21", "comment": "Malware payload (Mirai)", "value": "e00b6217147d6bb1c026d2842637fd8436f0a7d986017c29bdcbc923dab2f446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292376, "uuid": "9068c2ad-087b-4fdb-b827-d123cd6e2a02", "comment": "Malware payload (Mirai)", "value": "01c3b9dd6033c938f3ebc7ae067b8dc370ede086", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292376, "uuid": "c21ca518-d573-4fac-9221-4e94f1cd7e2f", "comment": "Malware payload (Mirai)", "value": "dc84fc93407d6244ea14dbb138af68cbfc1964f0bf0744e0703b3661b7f444f5b9d56b2dbbeb6b7f3bdc3ac771a43d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292376, "uuid": "5b04018c-fb58-47b4-94e9-f7e589f40203", "value": "T17A6302CBBEB02F26D0D8A1B5B13815D5D93ADDCBE243865D87E1A792073543760C8B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292376, "uuid": "7d8fa829-2e41-4a1e-95e2-ca09939c8b40", "value": "1536:NaxZLmYKVDNSl2y08yumeJyGYVmIMG3tNH:NaxZLmYKX+t08jmeJhYTdNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292376, "uuid": "ee2415e2-eea6-4f9c-a8f3-08fd4db0b853", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292376, "uuid": "4e3ffd31-2590-4f60-931f-c40ff344dc03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292376, "uuid": "53eb0e13-2801-4cc1-b7e9-3d7d9832e101", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af845053-e724-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1767280519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280519, "uuid": "ff4e1c15-2f52-4ab2-80d1-c3b425026905", "comment": "Malware payload (GCleaner)", "value": "4ae6288ee0edcf99cf79efab80dcb79a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280519, "uuid": "156101ad-34e0-4b2b-92b3-cc8bc9402879", "comment": "Malware payload (GCleaner)", "value": "e05b9eb14644039f025346b224ed5cd13ecf2f3ae92501fa067caa07ffc71545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280519, "uuid": "3bd2b509-2052-4e03-b4fb-391217f78564", "comment": "Malware payload (GCleaner)", "value": "a06b25b173413a61bf0170f806df934f2241dda4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767280519, "uuid": "6d15d349-7848-4707-b46f-a09c65219293", "comment": "Malware payload (GCleaner)", "value": "ee7752400f5776902e040c7cc2bee2a49edd50a0c7c55e38378b08b9829bd252d71f44814a7082da30ec7b05f0fcd79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280519, "uuid": "981518c9-1941-4b34-a473-2f1ce865d070", "value": "T12106E097F78700A1CDB6DBF8AD5FB123FB162873E92E60C912B55D452E35393250A232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280519, "uuid": "8fac7750-c0b8-49b8-8d8e-bc05f3798524", "value": "365dd928e86024ba833b1ea1cfbc5098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280519, "uuid": "a7b0420a-ca82-4bda-8322-c6cdb3a0ed3b", "value": "49152:qPeXHet1ly8QUhEFSlTSe/KPclsXRMFbFSerBaO6e98Y9NRlZ0KDtQyAJr/qgECG:qmXe1ITNeCP2/b1vQigEFYn2+OWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767280519, "uuid": "21e17858-89d2-491b-b6a1-8b052597dedf", "value": 3963152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767280519, "uuid": "5b7077c3-cf73-44cc-94d9-70b67efdb925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767280519, "uuid": "26fbe056-a52c-4b0a-ad9d-b5b773b633c2", "value": "gniscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342e5bc3-e72a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767282889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282889, "uuid": "b9785b15-07c3-490d-9dff-fc480d240076", "comment": "Malware payload", "value": "2138c0b949255bcc63224b75c8b84041", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282889, "uuid": "19740198-1a5d-4430-b235-8cbfac793290", "comment": "Malware payload", "value": "e0d2272a174740144dcfb7423723b3347d4850736592b437296278596b6bf83b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282889, "uuid": "744a41ac-827f-420a-aaae-751544ed9e7d", "comment": "Malware payload", "value": "985f83a48e106b5084a7b6d0727e49c73fa5926d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282889, "uuid": "65b311ce-d8ed-44b1-bc7d-df6e72c355e7", "comment": "Malware payload", "value": "4d01742f974a714b8872820cf519d908cffef163509f2ba49d1ba1c46999e74600e1dea4ac63d3b91ceb937d1d96076e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282889, "uuid": "9e87cf7a-977b-4a5a-a261-f16edfe9bad7", "value": "T17AE533A165446E9AE6AF823D9C97C203CD94F0C7FFE188DBCD0F9A028B564DE65F4460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282889, "uuid": "3d2b7b0c-88ad-4128-af60-d23650514103", "value": "dc7582daeca53ba9537917ac1c1a7ac6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282889, "uuid": "54941ed5-b70a-40c6-9b84-e87508517465", "value": "49152:HQnLmqM//tKtuOFKkzAgO2CRxvJyusflejAay5IEotr/pz8vaKT1HVcARIF:A/wEtunKAgkRZouMgvttrRgSKxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282889, "uuid": "fcec7f95-fa48-4869-af40-40f60f811883", "value": 3078144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282889, "uuid": "f08c7d02-d121-4c45-ac5d-8a826b2c306c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282889, "uuid": "df8af38b-7fe5-46a9-bd37-6d622d696e42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5486cff8-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270488, "uuid": "da0de09a-07dc-40b1-94fb-048a93c7d590", "comment": "Malware payload (Mirai)", "value": "1046cac8c27582ae6b1b6c31bdc3fe3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270488, "uuid": "057f5223-5299-4acc-bb07-135150cdd8e1", "comment": "Malware payload (Mirai)", "value": "e21865efacec0532586233b14d678ba604f1e3a0dc3f69304235cc165b80ad6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270488, "uuid": "a3864b51-21fe-4606-9c9c-f472f9db1ff1", "comment": "Malware payload (Mirai)", "value": "075b2af05fec76d4e501abc06cf175a9ae9047ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270488, "uuid": "549bcfd5-7728-4c33-8d83-30cf09b63710", "comment": "Malware payload (Mirai)", "value": "17bb7834b2c4329d068e81f932ef04b367f35b155c7cee4d1cc202637fdcf8f6de5ad1cba0d3e7cb22166523f8ac90cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270488, "uuid": "5d66746c-e1ab-4306-b392-347571ff211b", "value": "T19633D79178D15A2AC6E423BAF9AE408E3321B3E8D1DF7217CC241B047AD552F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270488, "uuid": "4b57fd9c-050c-45ef-913a-83a592f98e63", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270488, "uuid": "a029247a-7c73-4e9c-a6ab-23fdd0b16b3f", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270488, "uuid": "ccf9e637-8828-43b8-906d-8496f7f50669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270488, "uuid": "91cd27b6-ec5c-468f-a9c2-2293bfd699a2", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e0152f-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767228606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228606, "uuid": "d46f6db0-8e2d-4267-91d1-61deebe93036", "comment": "Malware payload (PureLogsStealer)", "value": "532299ec9155fb131a9e87b32bd4d9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228606, "uuid": "950ce408-9748-447a-bf79-637434fab9ae", "comment": "Malware payload (PureLogsStealer)", "value": "e24766de77521a19f2820e0cde95ef9b3171636f93c1da7901ab074218a0e36c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228606, "uuid": "738cba67-bb75-406d-b9e2-aeae30403cf3", "comment": "Malware payload (PureLogsStealer)", "value": "759915469444e4a5206e2702f8a9b81de9faf958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228606, "uuid": "35da9112-a912-48d9-a687-e8edf00d1a4c", "comment": "Malware payload (PureLogsStealer)", "value": "bcce313625b9bd9db7cc1ea15f0dddddeed3f1409358bd375d74044e0bbd084fb2985c80ae5f8721b970b62060600956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228606, "uuid": "eea36444-d41d-4d8a-ab74-548190588094", "value": "T128E41260265ACA16C4E24FF56C72D0B52BB8AEDEE865D30B8EE93DDF74793004915323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228606, "uuid": "17cab1e3-3aec-44fa-b7c6-9fae93a106bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228606, "uuid": "ccf71f7f-fce7-4f7e-a956-851d9d8075a5", "value": "12288:P8Bc6rDEDrXJEAfRugfGZGgQI9Iw4p3LOSCy32lHLUtt6JfYQhnCgcN:Px6rwfTgxQI9IV3LOC26tAJ7hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228606, "uuid": "fd0fd763-70b0-43b1-ac25-dd8b56a8496f", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228606, "uuid": "5415fd5f-8555-484b-b6af-0c9dd501666d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228606, "uuid": "6b4643b2-6cd5-417c-961b-d5b9cffe6b2c", "value": "532299ec9155fb131a9e87b32bd4d9d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9c5627-e71e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767277753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277753, "uuid": "b15124d7-6be9-4b1c-8295-205a94304c1d", "comment": "Malware payload (Vidar)", "value": "794fed8fe16a0e973c11758089c540e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277753, "uuid": "73fe6e8d-da30-4dba-9b06-d9cedb032e24", "comment": "Malware payload (Vidar)", "value": "e37cf388ef20a3dbb889454a4c0aea784ee0a43dbc42670a86b1f0bafd963135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277753, "uuid": "decaaa31-0a26-4189-a49d-44c7f9287add", "comment": "Malware payload (Vidar)", "value": "4e9fbdac6ff8a25ebaabca5c0408869cc0de4432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767277753, "uuid": "aa9ec492-c575-4a0b-9b46-90367207eba0", "comment": "Malware payload (Vidar)", "value": "a54691632faaf37e6ba2adc151846ab895d5a7a78f0f351d85d4cdfd3ccbd2abd59e8de3e0eb607774171b93d190e353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277753, "uuid": "2375d4b9-9e4d-4189-97cc-1b0714b01afe", "value": "T1C6761A83BE548369C5ABE179EE76A256B230B044033113D3AFA74BB14DC7AC4573B71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277753, "uuid": "72427853-77c2-4767-80c9-50fa52b003bd", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277753, "uuid": "873c62f5-1c66-4c9b-a58c-cf26288989d4", "value": "49152:x0AXjalrb/TBvO90dL3BmAFd4A64nsfJugB3B/xTDj/WI3ZLJCSdocFP48bn49Ky:x0j2xhDjhIDZLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767277753, "uuid": "666162cb-3c27-4b4f-8056-4383f370bbc3", "value": 7786112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767277753, "uuid": "2340af23-4f96-4338-bb4e-cedb1feee9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767277753, "uuid": "5c2406d2-de27-4f7b-b97d-781f30068b9e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723c5b9e-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295449, "uuid": "27aee6e6-9dd2-491a-8f5a-062bfc8a3a23", "comment": "Malware payload (Mirai)", "value": "ecf649a1347053a24659f0b3fe23bf51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295449, "uuid": "54471e78-1d05-4ce6-be65-3edaa3335052", "comment": "Malware payload (Mirai)", "value": "e38758e94b5f62a28111ede6ce39edb0f5cd939a2c04a14d0222aaa58cb7e2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295449, "uuid": "d73935dc-3cab-42ca-bcb6-c15c130b977d", "comment": "Malware payload (Mirai)", "value": "76f54bf48af2a8468243f49014c88173ec5c431a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295449, "uuid": "832b15f4-d342-4c04-9242-ab56412fb0a6", "comment": "Malware payload (Mirai)", "value": "7ff98d5a6fd55d3f8d85bb50227332ff366da2f7c90a84a836b4a9fd46d37de561ed583b535cb42c9aa7c31b79cba804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295449, "uuid": "d602e058-d273-4a5a-8e43-2ed6b47d4fa2", "value": "T1A2635BC0A683E8F1E96645B51037A3374B77F53A4079CBCBE774A532AC62A01D62B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295449, "uuid": "8402b4d2-426b-45d8-acd3-c3b57937d43c", "value": "1536:e6n35k8SWBN1+19leBlMKHh8xhSmeNM3QH357n/8PplEvzHoJYoRYfS:e6368SWB8qBlMeCShMg3578PpUToHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295449, "uuid": "05c0af5a-5006-44f3-836f-9e183f348f50", "value": 71028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295449, "uuid": "cff0b24f-c5b5-44f1-9f55-efb23ba8231d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295449, "uuid": "6e5802ea-f149-4df3-9a26-f25d0eb56144", "value": "goon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17817976-e6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767252776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252776, "uuid": "c1ff6e25-6e91-4f3a-ad14-7beb3ecd2573", "comment": "Malware payload (SalatStealer)", "value": "5d43f98fa585cc710f69ea2c542decc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252776, "uuid": "8b17b30a-55ff-4644-8e81-824a860cb586", "comment": "Malware payload (SalatStealer)", "value": "e43faba3401ec5175cb5fbca6e91ae312216df952f1026e91286f5375ee8fc41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252776, "uuid": "06076670-8bef-4fe5-a620-23bd0f79ad21", "comment": "Malware payload (SalatStealer)", "value": "12384d4b983edf04ff527b57fe1c3dfb7380cca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767252776, "uuid": "fcece5f9-5fcd-48d6-b90f-121d76b961ed", "comment": "Malware payload (SalatStealer)", "value": "7e92b7b97d0485754c7fe4bd03b152697b33424bce55fd2568592ff65cbbd981e31322ce55a0fa31915923a74d527358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252776, "uuid": "52106494-3984-4feb-b48b-c9dbedca15f8", "value": "T1CDE5331C09FB0E4CFC9651F629920DEA4B738F63995BA590C24CF03A3219D957DF68B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252776, "uuid": "bde142c6-50a2-4da0-a97d-f4dbdae4a115", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252776, "uuid": "72b1407a-9869-4118-be79-3bc18933182a", "value": "98304:1YzR72T+ExeJCNPl7/tA4kqY5x6EMc1v:1Y1S6Ul7XPvEMc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767252776, "uuid": "b5bde66e-b3b6-4e08-939f-438eddf316dd", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767252776, "uuid": "4e2cd981-1365-4d92-9124-6826be32e86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767252776, "uuid": "f49e808b-4e6f-44f1-90c7-466b37fb3632", "value": "5d43f98fa585cc710f69ea2c542decc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41011eb-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295989, "uuid": "95da09e6-bcee-4645-9829-600fc993823d", "comment": "Malware payload", "value": "52572b6915c460c3cc887f9d0820bf99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295989, "uuid": "3271b50c-624b-493a-9403-5fe0822f3813", "comment": "Malware payload", "value": "e46e93cd8f982d60b27453b39164420222548d76fb3a2dda4d475f9dce5274a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295989, "uuid": "22cca98b-fcca-483c-a087-54fc642c6a45", "comment": "Malware payload", "value": "97dc183c447fd44b6a698d330a03aa728ede07b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295989, "uuid": "5d4c5c1b-8a54-4cd6-9a7f-258c37868b5d", "comment": "Malware payload", "value": "da21a79f59a5ffb2d1433036e38a9fd755ea9d0c345973cbc046ba3672f220331a8dcd04a965714e75b90a00a992a461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295989, "uuid": "c6acce89-2c5c-4c4f-bbc9-01a6fc809176", "value": "T1EDC3AECBB24F5460C82247F41BC39BCD6E6362128E17C8F72C1E667B29795CB294B791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295989, "uuid": "f4122959-0e47-4c2e-bdde-f9f3d89fd30a", "value": "3072:fC6hw18RXHhffnaaNl+3gVQgFloLl+gMFkf+HngVq:ZO8zk37Lc02Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295989, "uuid": "f39e2100-bc3f-4a06-99e9-40963adb1f18", "value": 124272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295989, "uuid": "adff2042-0f55-47a1-b840-62d49e508337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295989, "uuid": "ea66963e-cf1c-4999-8dd5-90f9a06ad438", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b49b50-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228131, "uuid": "f481b8ce-98cc-4845-8bd4-7be73c025f12", "comment": "Malware payload (Mirai)", "value": "420a4d8557f2c452cb90a90d1ba71108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228131, "uuid": "b212e836-0b9e-46b6-ab04-0d35d72a3eed", "comment": "Malware payload (Mirai)", "value": "e4aef950bf272e525a402c0f28d85d577866504e4b1e1c4d3c919b9d7f866ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228131, "uuid": "e33bbbbd-1cf2-419f-a71d-20699cb48a25", "comment": "Malware payload (Mirai)", "value": "3c89ec88a656ce7fd047db100088e225cbe594ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228131, "uuid": "33195063-2710-4fa1-8d4a-291785116914", "comment": "Malware payload (Mirai)", "value": "c488a90c199c4ed5e1e61a00ae3408bf1c043a22f3132cef04c7af89aa4cbe9df2069c28086994101934d64a5a3cb6e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228131, "uuid": "386e7f73-d686-40cb-a81e-467ebcc95811", "value": "T1FD7312755388446759486433A23D89CD769E3EDC83FD3F26227614219366C2BFAF4833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228131, "uuid": "1403e14a-a69b-4316-95d5-ca8956eddbf6", "value": "1536:N+yzTaMng4+AL0UkbFAZV/upTeZAQ6dA0sZXz9oJP/Jzv:N+WVYhWZteMf0s5qh/JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228131, "uuid": "ba3b727a-1d5c-4d5b-a287-569fccac5451", "value": 73808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228131, "uuid": "4afd9caf-20ec-4dd3-9442-06ca01ddc5fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228131, "uuid": "d53d8e46-0213-4793-bada-963e526135e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe8029b-e74c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767297800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297800, "uuid": "005399dd-7d0b-4068-b0e3-3c9015c0b10c", "comment": "Malware payload", "value": "4d653bf8558b6f473d410d98c4f15c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297800, "uuid": "f0f9ff43-9f26-4923-b361-ebdb78a0a535", "comment": "Malware payload", "value": "e5a2e6bca7c36b26b1f24854188f3084862768c7f16b16c50d58e376646a572b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297800, "uuid": "9d95ebfa-bc97-4512-9d45-23b3a2154afc", "comment": "Malware payload", "value": "a28554ed4f4bd4bd8b144107ad2c96334d2d8b8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767297800, "uuid": "6b31628b-bb84-44a8-9604-fc716fb99f12", "comment": "Malware payload", "value": "fa54d8f43d65e89d8c468af318bc178f72dce5d48ab49e378ecb4bc1bebf76872800a06bd42ecddb8f2f5a24d480ae24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297800, "uuid": "914bc446-0c39-4450-82cd-29f61290ba22", "value": "T162C44C59F8409F91CAD529BAF65D929C33070779C3EBB20799245B343BC78AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297800, "uuid": "bc96a09f-26c8-42d3-aa84-c10fdeea8885", "value": "6144:R2IIx2/mgZzUtpZkNj2FpJVZe97DtPwv0j6voLyTK9WwJi1xrDGtYgrgpZ6mxhx:l8cZzcF2SyvTi/riVgpZ6mx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767297800, "uuid": "93fa0b0b-afad-417c-90fe-c6cfd9197bcb", "value": 553740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767297800, "uuid": "b955a8aa-5914-4e11-8909-06fb42e82371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767297800, "uuid": "e5177d72-3c43-4a22-bb96-3dd88b4d2e20", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1682ae66-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304314, "uuid": "2c47c27e-6155-4e98-8743-1e9022b33e4f", "comment": "Malware payload", "value": "92920d434e5ba97ea0c7277413ad9390", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304314, "uuid": "676be251-b0c6-47f6-ade9-5075247d78f2", "comment": "Malware payload", "value": "e5a4aefd20da1c026fb42fe4608b6d04e3be992a4024d53262195a5067b17bb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304314, "uuid": "8e03c2b3-4d8e-4a9b-96b8-cc5f6dee71af", "comment": "Malware payload", "value": "e083d8505cb610e4160e90a1f153fad3f2c6d841", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304314, "uuid": "db676230-a6d0-4c05-a15c-70391f426b41", "comment": "Malware payload", "value": "572bd3b5b8c3e66e69bf53c6004fe99713d5a26c08f944f3ab317695922ef9a6525e8275a69592a1d2a73cf2a2276341", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304314, "uuid": "96aa9a9b-4026-4344-b8d1-e2f66dccda04", "value": "T1A7F39721A3FD4108F6F73F84AEB462655E36BCA6AD79D2AC1261004E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304314, "uuid": "9a1db834-65c1-446e-ada9-fd17484c5a3f", "value": "1536:1t5ovJKYx/5oMjnvnYf7bNH1hqv2Zzo8ncW30ufjqg3vnYf7bNH1hqvx:1t5ov3Z5oMjfWp5Zt08FPWpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304314, "uuid": "5a6bd16c-d075-4bdb-9ac4-d2e73c6a1f4c", "value": 166836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304314, "uuid": "89e87e74-696b-4f5d-b80a-57c1b732d652", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304314, "uuid": "649a83ce-5f3e-4e8c-a7b1-30201a872c2e", "value": "Gift_Fuel_card.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c65f55-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304575, "uuid": "b9c6acf7-ef04-4a69-8ff4-46e551bfa846", "comment": "Malware payload", "value": "df5a2c1fdea2e179255f7f63f1b20574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304575, "uuid": "3ec61bcc-4def-45c6-8239-fc205afab2bc", "comment": "Malware payload", "value": "e63fa533fec8b8089ff5878389cdf93d42eb64e9fe8e48d0dab3b0cdc5bb737c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304575, "uuid": "123fbf33-db6f-4da9-a077-b6b14037c50f", "comment": "Malware payload", "value": "f3740be689dcb20c0d200d699d76a551624069ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304575, "uuid": "bda4f2b1-ae64-4a9a-88d8-eae4b0105874", "comment": "Malware payload", "value": "cce4650dccf3ad6fb045862dbcd4ecaf83be28e5e4693f77c14e94baf3893a83a95ec4fbe73f80273dd1037dfa69daf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304575, "uuid": "8cb9fb2a-92c3-42bc-9439-66b2483c5fa9", "value": "T1D6460787B9924943C4E4367BB9BE81C433631EBA9B8752576D15FE383ABE1D90E34304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304575, "uuid": "976c2358-2309-4510-b3ba-30fddd601dde", "value": "49152:nOPPRNvKF4Pbh46zORHkU/BNo0R/bJlN8dfyND6A9OvIviKl5EI:nOPPRNvvPbh4LKmt7NayivIv5EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304575, "uuid": "ff6852ba-bf7d-4f37-98bf-417ff15ad6d9", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304575, "uuid": "96049978-1d95-4242-8483-0fb13dc1c124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304575, "uuid": "60c6c6fd-b369-4d7e-82ee-d4576136a760", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cdbb31-e6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767228312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228312, "uuid": "5bf35a3f-d547-43a7-99bc-ab98608159c3", "comment": "Malware payload (Mirai)", "value": "0410b4442b21c652655fa05554cc3ed0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228312, "uuid": "c1ff8f75-5aa5-4bc4-b692-f33c6b2be4dc", "comment": "Malware payload (Mirai)", "value": "e66eff3d0b2a8d2073320d931f823b6f3db187840e97ef3a1413fa3f3faf3c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228312, "uuid": "e78bb1d9-e48e-40de-aa94-15634ac15e1e", "comment": "Malware payload (Mirai)", "value": "7ba53c323966651a7e4d8470f2b01b313f94bddf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767228312, "uuid": "5f5d7335-e2db-46da-b167-1c89e1135312", "comment": "Malware payload (Mirai)", "value": "7fec4f81e4bfc8cc0ccf09fbce2065301e02be132da9e55746ed570c4fb2ef745f90a69c8e21504e49c3f35e57e7c79f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228312, "uuid": "67cf0045-b1fc-46d5-ae15-243c9ea9a03a", "value": "T1C91318C99D83C8F5DC0A1935147BE73256F5E536107CFA9BDB94E9366863302B20A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228312, "uuid": "18725638-cc62-4ed2-98de-77bc34ba000c", "value": "768:Nz+DIU4tvf3fBYcjI1U9HiBSjVX+I4PQ2Pqa5njtXf3/Ue6609bp6AS6GdIC8f+C:NzkI3vPfBYcjI1U9HiBSjVX+I4PQ2PqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767228312, "uuid": "0635dec0-d16b-4e8e-a8b3-e8a369faf0ed", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767228312, "uuid": "f32cb75f-8d9a-4af8-8796-cbd425f430aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767228312, "uuid": "80f4691a-7f59-4b57-9e9c-388d4ce3a43a", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48580f5e-e6aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767227948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227948, "uuid": "f6ffbed0-58eb-48f0-94e6-cd93aef65c15", "comment": "Malware payload", "value": "6386a88b2c2c2f67097ea6558a3c9aa8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227948, "uuid": "a6e672ef-4ff3-46fa-89eb-1d809e31c072", "comment": "Malware payload", "value": "e6ce4244e5aa5f353e6d7aca94faf69d2db0cee971342d376873de0b6b51b30a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227948, "uuid": "b798fb0a-7b12-4fa6-8c53-f3c5f8e192ba", "comment": "Malware payload", "value": "a800a50b03e798992418c6538800ab35c52d893d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227948, "uuid": "fd04c123-a7e2-4dc0-a946-576084a4314b", "comment": "Malware payload", "value": "9854bffcb6d33f2d6e0b32c4c2fa09c2df669d1699d3e39ba94e3ce65d6d0472597af91bd7c6088d1b3f27cd51f03779", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227948, "uuid": "6566cd39-17c5-4037-b87e-2e9e9eb231fa", "value": "T169E1D886BCF32419741B405DCFBAA25870696057470ACD9CFDCC71A8DF0C5A45622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227948, "uuid": "fba5c45e-c515-44ef-ae04-6a7ca9e55e19", "value": "192:OZrIE/CTK/e76Fw0llHYoHsfOBro2Tc/OCguSmy:Of/c6FtYoHsfO2/Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227948, "uuid": "14aeda93-3b40-4097-a321-425e005d86af", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227948, "uuid": "4fd9a895-835d-483d-a4e4-ce953fafee1f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227948, "uuid": "1cb2dbc4-004c-46ea-8953-792c2847a476", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9761fa-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233302, "uuid": "0682d921-6f2f-4f28-b514-d441a917f649", "comment": "Malware payload (Mirai)", "value": "8e1656d44439693530fd07aca587f51c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233302, "uuid": "4ccd8a6b-a9ed-4a82-a275-e90e1767403e", "comment": "Malware payload (Mirai)", "value": "e6f3f542247c1dd73111b034681406ac8fb18115795e8544f871a22ae9f6e98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233302, "uuid": "c1117ade-5bca-4357-8745-e089a6a8c6b1", "comment": "Malware payload (Mirai)", "value": "41d2767915ad9d3e55dc2582b180af017bda923c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233302, "uuid": "505f1376-2717-4250-8c4e-71ee1930feb1", "comment": "Malware payload (Mirai)", "value": "bf9766cb9b9e688e103f9fe4aa2e0cd8248d6f1a38ad11f7457ad619e5cb21b67e8d80efecdd0b82755bfb6fa8a31ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233302, "uuid": "d073c19c-82ae-4f4e-a121-bc03b334cfd7", "value": "T1B123F11BC7B89830F63AE1BB9E3F164D1804E54934E00FD25AD04EEBB9CBF7159285A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233302, "uuid": "c3c3894d-fd8c-4f61-92d3-8cec181a09f4", "value": "768:BessG0aMqhrQPOj9aavzQ2FGf9NeVTsrN/yRCnY5xlwBlPlAIcBn6isTA17+Cnb+:BessLiF2oGfOsrNqRCWYHlzXTA17nno7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233302, "uuid": "53f1d80b-77a6-4f89-819c-592f5cf1b80b", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233302, "uuid": "81f49a76-3525-4f8e-8d5f-196d9cb11b61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233302, "uuid": "b4a6c992-24f3-42a3-81d0-ad421f03755a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1982cf5-e6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767254780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254780, "uuid": "6cd5f029-caff-4ad6-8bb1-5e7bd2374ba3", "comment": "Malware payload (Mirai)", "value": "b382773b6f808dc0bc7b3d987f7c53bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254780, "uuid": "eb402081-197a-4f50-9af4-b586f5271d46", "comment": "Malware payload (Mirai)", "value": "e88df9ec53192e6e713c23e873de60aa975bcbe2b0ca5bce1835234c94aeef1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254780, "uuid": "7c6a8694-742f-4a5f-8827-87664adb4ece", "comment": "Malware payload (Mirai)", "value": "8903f4783c4eec26b9384fe8bd03c0b990f6bb03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767254780, "uuid": "f679ba37-b330-4eb9-ba61-af301b1c512b", "comment": "Malware payload (Mirai)", "value": "a30bc02f9559fb113c1e9070cde5a4509390326651c52276d9025ba53a35c103ac63379e1fccbe2f7fd8ed3520b5ed88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254780, "uuid": "25c0413e-5bae-448a-a00d-129118226a88", "value": "T1FF934A85FC819612D6C1137BFB2E228E372663A4D2DE3203DE15AF2133C669B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254780, "uuid": "b98c13b3-0440-4a8f-b014-7f85d238364f", "value": "1536:EysvVDQYWEEuJaUHicRdMAeBkrPfKzMXrPgPUpiHclZvaKd:EysvVDQYWEJadMM4PfKzYjxDaKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767254780, "uuid": "fb6f5c06-293d-4999-aa7c-345cb8005643", "value": 93108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767254780, "uuid": "7ef20092-249d-4f93-b9e2-d4c0cd3ddd03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767254780, "uuid": "7fad534c-d13a-4e24-bc47-6afa1b2d9294", "value": "m9x7k2v8b3.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b9c516-e744-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767294198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294198, "uuid": "ba6eb0a9-5299-498a-9404-92f7a98fa5c5", "comment": "Malware payload (Mirai)", "value": "2abd6ae06b1c90ee348fecb43efe1893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294198, "uuid": "e972756b-2666-476d-b6a6-57f0607a89d7", "comment": "Malware payload (Mirai)", "value": "e92d98474782e67be0be6e81c9c6e0b01aad629859a142149294309a8a92b2be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294198, "uuid": "e7534379-40a4-43ea-9df0-1a5398039a21", "comment": "Malware payload (Mirai)", "value": "da0d52b69244c18bdde02cfeff1a57da20fc28fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767294198, "uuid": "b89ac2a9-9c38-4c24-89e3-5a022af85747", "comment": "Malware payload (Mirai)", "value": "84ae65201a84428208d40d5e9eee996bee1ca3fbfdf913e767b75a587012bbaec8af86087df97393b8a3bb79e64d73be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294198, "uuid": "e5c9b908-e80f-4416-a337-941f643f2c89", "value": "T1DB44E50AAB610EFBE8AFCE3306E91B4128CD641721A83B757674D518F50E64F1AE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294198, "uuid": "7b2900ba-6573-4fd4-8560-21e366681de2", "value": "6144:OxHWtsA3dwzBuw2dubByaHLFxIdlsGnM3acp5LZGZ:Ox2tsANPU9lxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767294198, "uuid": "14e9a13b-8bae-49ac-86bb-7ae7220445b8", "value": 269384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767294198, "uuid": "469f3a23-958c-4415-83fa-a7aeeb779c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767294198, "uuid": "a9a67a68-a04a-4184-bdd5-c4bcad712ab6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdf7978-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270663, "uuid": "840d1c6d-a1a7-4c26-8169-ba417a156302", "comment": "Malware payload (Mirai)", "value": "216a7c88d629b7cb401c7a2792e6cf45", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270663, "uuid": "50c601c5-1f7e-4570-8f11-58b4dfc92d9a", "comment": "Malware payload (Mirai)", "value": "e9d5e38a71253bccedee22ddf38c4e661e1190dfdf890a527b174e8a0b5b971d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270663, "uuid": "561f6828-ad5d-41ff-8ca1-0a2bc5bd5a99", "comment": "Malware payload (Mirai)", "value": "12994d53b950251a220ca5044a308aff6ab54f25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270663, "uuid": "552da7e4-800b-4408-b621-cffe004577f5", "comment": "Malware payload (Mirai)", "value": "653df49811e67d47cbf259843ed4c55a0b50ddd82280e929fb60d5a18f6bd9b54c10f87acd31ba2a18e09cea3e2f5bc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270663, "uuid": "ecaf21c3-d115-4f60-99c5-570365906d95", "value": "T1CB3132D959B74D76AFB5996A72F504547180E08A2ED3EDC8E8FC34E8488FD447086EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270663, "uuid": "0cd995e0-f00c-4400-b7c5-6a11e2f1375b", "value": "24:v3vQFskoLBSOSuJJgAssqEAYL83AdksDAkhzxN4Ihq+S:v3dVSAJvssqrYLzdJEkbTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270663, "uuid": "4f8992c7-d235-49f4-9394-23f9bf689a48", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270663, "uuid": "54a24174-6c52-482b-9075-c6784624b13a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270663, "uuid": "4c789478-ff65-4f02-9f8c-0d486fe5fa1c", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5fb674-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233296, "uuid": "bab7aafb-ff9c-4835-85b4-6a19a35ca9f4", "comment": "Malware payload (Mirai)", "value": "3667315706cce73f11a1cc33526bb030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233296, "uuid": "eaf4cdfe-276f-4e60-9ab5-ad3eaf6fceb3", "comment": "Malware payload (Mirai)", "value": "ea96758b6309f81b7b6731b160c4d1bc79a4a9ab38d61b420edc9444ec1e7d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233296, "uuid": "7b8c4f85-b733-44ec-836b-fba457e48fc3", "comment": "Malware payload (Mirai)", "value": "265161f87c3d68c812a9432a7bfcae6bf652881e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233296, "uuid": "208d81d7-5573-440c-b372-15ca1570ef6e", "comment": "Malware payload (Mirai)", "value": "c68182eaf11b0904b69c2884bb3e32ee37d9eef1c3668e9511afaa121bbf10413576a66e7fb47d676dec0111e0d08855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233296, "uuid": "414a084b-156d-4432-9a88-d03b0684d998", "value": "T19973121A2F5B3C524BB237B99C98018E2C851B9CE47DB53FB24B8B1426C6A931F9C549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233296, "uuid": "05de8a85-e2f0-49dc-a92e-8c6ff6080b33", "value": "1536:C8IHq+kgsIGQy+wCnu29vywakR0ZmL4BcGXUqhXn6u:tIHq+iQsku2h1/GZmLF5Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233296, "uuid": "c055bc09-952b-49d2-89ac-1ec800721f47", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233296, "uuid": "2f158429-87dc-4b41-b3be-3cc60acb1ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233296, "uuid": "79c27ebf-0254-44aa-b71f-0e1562db41b2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b87ca6-e6db-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767249010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249010, "uuid": "8827a55b-159a-4973-a1df-1bd27c0d1c3b", "comment": "Malware payload (ValleyRAT)", "value": "ed6ad9daf2868e4ba2dfeb2ed4ffdab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249010, "uuid": "bbc0300b-9eba-465d-a7bc-a8bfca726fdb", "comment": "Malware payload (ValleyRAT)", "value": "eaa0b7e65f2006d797d8264cdde107c98e0fc807fd7d97239ace335477e9024e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249010, "uuid": "804a7b59-ce5f-4699-8f8c-aabb525e34b9", "comment": "Malware payload (ValleyRAT)", "value": "b92d05a289e4d0e85fd46bf549876dd21b02f963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767249010, "uuid": "04ddd222-ee76-4c61-a41e-074f3937b606", "comment": "Malware payload (ValleyRAT)", "value": "52387edb2420b4977ba1c138114e5305b5f8d62bd7f96508d423728c53d62a29256ea458268fb1ebd08f2b10a7c87627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249010, "uuid": "376f51e9-be7b-4913-a517-1ec8ca95b8ab", "value": "T1E7380142ADA303A2DD0D76FD70AD233958E08D4F0F2452A65FE7DD25CF2E1906A62D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249010, "uuid": "3fd4325e-0659-4c36-a55b-be045d0f9fbe", "value": "a148a8db492373de1476064a76421f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249010, "uuid": "d254671d-549f-4264-97ef-0d1cbb6309d1", "value": "98304:rHdBILINRjXlLZCQg7tGb85bt4R80wsAufjGe7LB3CB7sFnwuajGe/PF:zsMRjVlCQgpGbpNwFGBmQFnPjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767249010, "uuid": "7749d0ef-e818-4397-beeb-1e7b1e9ab8e1", "value": 103445876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767249010, "uuid": "47a04c5b-cf5f-4c75-bd49-c929c04e2808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767249010, "uuid": "e1922bad-892e-4714-a12b-0131c0c23983", "value": "ED6AD9DAF2868E4BA2DFEB2ED4FFDAB1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26fe021-e6a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767226085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "6da048f4-4aec-4752-83b3-52659223a0b1", "comment": "Malware payload", "value": "2ae0da2bfb08184b99df1db5c102b44e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "00f711cd-ecec-420a-9a72-0b430d0905c5", "comment": "Malware payload", "value": "eaffd9a0ecd8bc09abbb12bc195a4fb546b9b638e5a650244a006489e7a26c10", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "237c9d67-01cc-4f4d-9230-f4f83cecd534", "comment": "Malware payload", "value": "d29d33ab8b70df6b0ddf12b82d1f9029771d78d6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226085, "uuid": "579b7aab-81b5-4761-aeda-f6d1c56d2ac2", "comment": "Malware payload", "value": "cd0b4d2d03abed975d094d5b3f03646a532e684250db5a7ffe6885077d6ebe775200340e559332c9cf7ac7abd97ae450", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "16574fac-3c24-4322-b359-180de510a499", "value": "T189C2F83AC984AFF01B2FA2929D4B3D1545454326B6753A0D75CEA9EC2B39320CFD41EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "466a012f-41da-481c-9091-c0414f927d8a", "value": "768:K3iezTFqIV6p5RDEL/5bCylCNFVhs8ktDjtlp3ilMWh:2ienFqIIp5RDELBbCyloFoNZjp3ilPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226085, "uuid": "aa67e304-2370-4a2f-b6e3-b1a04f433178", "value": 28254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226085, "uuid": "3f1aa945-49a3-4b24-999a-ab5f63c36e11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226085, "uuid": "639211bf-cde3-4141-a6b0-dc9878bb9f82", "value": "host.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaddc0bf-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767304563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304563, "uuid": "6137fb1d-344b-4fe0-8737-e768070149af", "comment": "Malware payload (Mirai)", "value": "81e07ee7684054c994025501f2b2dcc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304563, "uuid": "7811ae3a-ec18-412d-b9f4-9db86f883a85", "comment": "Malware payload (Mirai)", "value": "ebb5784416a0f1ba1db4c4cf93d446fe5ccbcebfb8c1dd07581802839dbcca30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304563, "uuid": "d3de4504-1bc1-4a19-aeac-76ab28d31ac4", "comment": "Malware payload (Mirai)", "value": "ee4d68be0ab072c3b7d4ea947a43f6e9bc4153a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304563, "uuid": "dcb01db2-fe03-4f96-aeaa-6e0be01ad0a0", "comment": "Malware payload (Mirai)", "value": "663b3dde802dbad61cde744dc4c2e567649b0fab5e94dcf23d50d1a7db2afc945d22abf1458d1e5b3ebe4c1e9db6dc4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304563, "uuid": "e003871f-64a7-4de5-8195-23bf7d7d4cc8", "value": "T16C530845BC91D616C6D462BBFA1E42CC332663E8E1DE7203DD21AF15778A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304563, "uuid": "7cc49ecd-d347-47c7-86fd-c47f20cd76c2", "value": "768:eRlbqPDcKRs1/RgWdDPafmkYOsgS+uGGnJm95ev9IH4mN7IZVBwzw8uJYcmu+7RP:IbxKoPafRY5gBu7nJOeVsFIWzIku+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304563, "uuid": "b9f99ae9-4e3f-4aa9-b5d9-d137f4fa49dd", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304563, "uuid": "93a96343-20f7-4a73-8793-ce263e53169e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304563, "uuid": "150a4906-cfc3-4206-baae-4c3324a662d2", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6761fcb5-e6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767253340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253340, "uuid": "a1742077-2fd1-4373-a092-79b8aa62a5d9", "comment": "Malware payload (Mirai)", "value": "68a7a9a5578c68a1926ae820325f1cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253340, "uuid": "1c662d44-4eab-401c-b074-2ca7c20610a2", "comment": "Malware payload (Mirai)", "value": "ebe7fbb0bfb1870155a408bfe0a5f7ba3f29f87285a27eb77418d079e9c63e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253340, "uuid": "01938605-3b61-42bd-b75a-889b12b2ecb9", "comment": "Malware payload (Mirai)", "value": "b3454bd3a26db9708570cfa457b0d26522a6fe4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767253340, "uuid": "5c452066-2845-4295-b068-5e927251b6c0", "comment": "Malware payload (Mirai)", "value": "1fbd5464952eadb94aa2e3fd19c8e03513d935322bf3a1cfa0524262f78fb48f59637ccd05f4dd869d1490b22d2b12be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253340, "uuid": "2a772c5a-7f7f-435e-8413-dca9b965e743", "value": "T129831956B8814B12D5C512BEFE1E118E3323177CE3DEB2229D106F24778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253340, "uuid": "8681bdb4-895f-42ba-871e-17e6024f858b", "value": "1536:04ntdqPdyWw9RzawtCc85aayPAF+lMLiNXBfz0y7HC5WYj:Edx+zd8c85aaCXBfz0yTC0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767253340, "uuid": "6677b652-0c16-4095-b9b3-2dfbb87e8fb0", "value": 83428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767253340, "uuid": "57dd8536-12d7-41a5-b902-7489da58e0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767253340, "uuid": "a3a4c435-95a9-4eda-94cc-9d48a918b3ec", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e154b2-e70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767270487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270487, "uuid": "8560abc4-f6b4-430b-a879-6de160590fdd", "comment": "Malware payload (Mirai)", "value": "1746cc7e43570a526aca6c812708f64c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270487, "uuid": "bd212c2e-4667-43b6-92d6-61e3af60b3a8", "comment": "Malware payload (Mirai)", "value": "ec8ce5ca403c4006cfa138e09933acd6121445f2014613b47ccaebba7393737c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270487, "uuid": "e921a5a5-2310-4539-ac2b-1913a2b2c3f2", "comment": "Malware payload (Mirai)", "value": "19cf41d8936bc2ef518ba5123bc82b758ce5bc47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767270487, "uuid": "2ca7529f-98e7-45c9-a825-10f551fe8c8b", "comment": "Malware payload (Mirai)", "value": "72e529ee5fc66ac377a92cfd4115ba04ac5283662b01e586c0b2f23efa6b6708ae83bae2bec8d292494db198351bce5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270487, "uuid": "9988fca5-9070-4152-a731-33614bf822e5", "value": "T1BD334BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270487, "uuid": "49523c29-20e7-4450-90f2-e96c388803a0", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN66OQ6xpwhNbr/I:xZebkP/Ad39UMJRlhN7L6bIbDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767270487, "uuid": "2bb7b614-fee0-4775-a1ac-80eb9f89ecd6", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767270487, "uuid": "17430372-6a5a-44cf-86cd-902795f3aa1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767270487, "uuid": "3287349b-b078-4d71-8802-cefedb8b8499", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a74fec3-e73b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767290228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290228, "uuid": "509f7b44-2da3-4e22-a16c-86fd76761838", "comment": "Malware payload (AsyncRAT)", "value": "7b99b5d05043252b14c26914ea8062b7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290228, "uuid": "94c4cc16-a8af-4f34-823d-a6d55a6c69af", "comment": "Malware payload (AsyncRAT)", "value": "ecc5329a836676815a3e69c4dc16544e2c4860e3e1fd6e26057e0c77e2571032", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290228, "uuid": "0d78eca8-1d71-49cf-ab9c-4ec1e0e789d3", "comment": "Malware payload (AsyncRAT)", "value": "d2d549247f467abfd7cfe5d6a9aba6f2d41ecd71", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290228, "uuid": "ffca27c8-2d8a-4391-9954-a67a4ab93ab7", "comment": "Malware payload (AsyncRAT)", "value": "dee503e2f1f7582c754b3eb2adec1345a5136ef36bd1a1d1ade8e7ef8a9a38f5011256dd4923c2671e7dbde36221a5d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290228, "uuid": "428d97b2-4505-4d87-8749-0449dbe731c4", "value": "T171231B003BE8822BF2BE4F789DF26145867AF5672613D64D1CC4419B5723BC68A427FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290228, "uuid": "45da7805-f49e-4b5a-bb36-0ecbfe46db80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290228, "uuid": "b72a5b88-b207-407c-9461-722d3c226d8e", "value": "768:xuwtNTR56NLWU3SmZmo2q7+8fIrTz9VkfsOPIazjb3gXii5oTxaNilw4QDMMBDZ3:xuwtNTRc92OwF6k3a3bQXL5oTxaSnKd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767290228, "uuid": "8ce541ee-4e16-4a2e-9d74-e127e98a47f2", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767290228, "uuid": "023fb3e3-4f1b-4a97-b127-6f0397029f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290228, "uuid": "c302893a-3752-4cd6-98b3-fbde2632d456", "value": "ArgusCloudWatchtower.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3421cb6-e748-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "06c0dd57-2f34-48d3-81ed-ce3662e005e3", "comment": "Malware payload", "value": "4e44c4773d594f525c4ad054df1b26f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "24d9578b-5b86-4f4e-9ea1-b9cdcb2193c1", "comment": "Malware payload", "value": "ece8e06d04763a06d337edeb5566add9e590b63bbcacc418a6cfc2ecafe5dd7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "5cc8d2e2-930e-4b09-a36a-6b6ffd09e434", "comment": "Malware payload", "value": "177df1a01a4cc9fd9ca8d1e56a4deff7af928d2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295987, "uuid": "be6dfdd7-f921-448d-b3b1-8611e5490fe6", "comment": "Malware payload", "value": "4174b8af7a1646cb6a5085f0fe46577ae14d4723c28c799bb637acd238589844a359ce20f4511e93cd6b8588af1cb6e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "982ec28f-fe9b-4a17-b795-168dfce0754a", "value": "T1FC51E3D83861B6B76E89CF48E0714F3D640FF4C425D1CED8EA6F14A9857EB0A703A619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "055b394c-a1ea-41c8-8c3a-ccb9c439f92d", "value": "48:z56q+kdcO9pY65q6e/GLcoHIHxxHx6ED6WOvReE34:F6q+kdp9pYqq6e/GLbHKjDD6lR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295987, "uuid": "35f967d2-f454-43dc-a85f-4f30d0ffe10a", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295987, "uuid": "4c4cf30e-0971-4bad-90a4-8f8e7b22021b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295987, "uuid": "cb1f9727-d8ed-45f1-a1ca-ba8042937a5c", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a8c3f4-e70f-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767271555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271555, "uuid": "9bf21159-bae4-4b46-ad85-0e7fae985a08", "comment": "Malware payload (CoinMiner)", "value": "686787286ce52d0a58660a027a3df7c9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271555, "uuid": "576ccd8c-c044-4b0c-843a-cf908123748d", "comment": "Malware payload (CoinMiner)", "value": "ed50d381726b6b765130c2f6da39be2ce85fbcb829ae2444902b258a94f7feb8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271555, "uuid": "b1614d78-8587-4eb6-9d06-67d106fcee9e", "comment": "Malware payload (CoinMiner)", "value": "ff0b4fac4b70083aba7f1da09b2932e074fffdd4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767271555, "uuid": "433b5966-1dd8-48e2-b9e8-a70950779bf9", "comment": "Malware payload (CoinMiner)", "value": "f674b59eaa0158a6ae36425772b23c78ee8f95fd5832b3c7a052d1e20096a24c4c1f1b7cd134a2e8dd8fefbf4318b97f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271555, "uuid": "7c7c3bca-0353-4f45-8e28-dad8e58ae151", "value": "T171565C03ECA559E5C0AEE2318A669253BB717C481B3123D73F90F7282F76BD0AA75750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271555, "uuid": "b76f294d-5b75-463b-b824-6992c7ec86f3", "value": "98304:sINkscufZcqSGWMqJjWzMXke2zcEm7NG5uzTS:sOcVGWVJWohQm7G+TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767271555, "uuid": "6cc10991-6647-4877-8b87-50609a6ba982", "value": 6274765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767271555, "uuid": "c7cd0867-6154-49fe-88d5-1c7faed84ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767271555, "uuid": "6e9ba3aa-7f61-4352-9086-ffb0f760c102", "value": "px1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254856d0-e6f7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767260960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260960, "uuid": "fcf6b84a-76ea-43b6-904d-66633c1233c8", "comment": "Malware payload", "value": "9e27b3a27bd609de9d68f3ca31a4f5bd", "object_relation": "md5", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260960, "uuid": "12fe454a-da68-4701-be71-9e42597cb072", "comment": "Malware payload", "value": "edc12695edc3ae24f6ddd43b40c5cdd63d4375820da845a4475b7996f10d9bd4", "object_relation": "sha256", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260960, "uuid": "d5b44e75-10bf-4b89-b605-48a1e2e0c78c", "comment": "Malware payload", "value": "0f946544cc9e9ce3e7598bd788fa7d670765776f", "object_relation": "sha1", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260960, "uuid": "ee27fcac-2ce0-4164-9500-ee5f5c74811e", "comment": "Malware payload", "value": "41b8729e4db5a385d24a3c0378fae6d3c1fd0d4e2559ecdbe45467b5dae475edff513f1da04674581fd4d0e8a6965588", "object_relation": "sha3-384", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260960, "uuid": "0f7de344-2714-4ec0-915e-2e02570f3e33", "value": "T170247E5576A910F9E6779538CD024905DA72BC5657A0EB8F03A00FB68F33BE09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260960, "uuid": "bedd51df-84f0-4c12-8f0f-235b7eee60e0", "value": "94aaa6be10ea7cb0d157f724612577de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260960, "uuid": "d4e591a4-c344-48a3-9047-edae37946f9a", "value": "3072:QzcnJQFltnpSEZsXEphxF7zxd+xFwKd2Wijnpt7AiHshVK3KbRkM4Z0JN+:jUnSEIsBTMwnWb/IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767260960, "uuid": "0ca841b7-1d84-4b80-8351-b4bd7c84a5c3", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767260960, "uuid": "11d7bd32-25a4-42ff-9ac4-92850d2d3ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260960, "uuid": "1bfa673e-e973-404f-b57a-0e14927f6f69", "value": "words.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2813371e-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272132, "uuid": "a8fcab0f-e840-4cbb-8a67-9087f118c353", "comment": "Malware payload (Mirai)", "value": "5011dff475552e34d8fab9d1911b24ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272132, "uuid": "233fbb5a-f9c5-41ec-afae-c08f91f0328d", "comment": "Malware payload (Mirai)", "value": "eec17c36bee409de0121211b202a8282d4409612d7ecdc58d2fbfbc1ae78ce0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272132, "uuid": "18459fcd-ac6e-42b9-9d19-86066d6d35f6", "comment": "Malware payload (Mirai)", "value": "9d0ded15ed640c480f90910ea24fbeee1ccb401f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272132, "uuid": "629805b4-8e38-4a5e-9330-61ae53a0ef51", "comment": "Malware payload (Mirai)", "value": "0378549d14021c8f53149785d36a176ceb63af5183ac2e7845408ee8aa621eed23f3b0b1213d4310542346a378a0b122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272132, "uuid": "6308ecfa-4142-435b-8c5e-c1e7a104b006", "value": "T1C654B6BA77107FAAC368C23805F343E996F3235116A39505E12DCA2C1E6538C5EDFEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272132, "uuid": "04189cbb-ce8b-49b1-911c-20a77188f379", "value": "6144:5tELRUYfHvveKWQ2pEQXfjGONbhuBrgaJz1MFybW1:5tELTpMjR1cz2ybW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272132, "uuid": "73c4fbee-d90b-4b73-9c05-d75e5ac328bd", "value": 291300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272132, "uuid": "f561a985-db7d-402a-81b5-b4b5ae1f0c9b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272132, "uuid": "0caa7b38-3bac-4122-b0a0-754cf0938001", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c72f9b1-e742-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767293131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293131, "uuid": "010bb999-2803-4f42-8811-9e8c97157433", "comment": "Malware payload (Mirai)", "value": "565dbf3272da16133c7708904938a061", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293131, "uuid": "5520b819-2f0f-488f-9c1c-73522fe3d453", "comment": "Malware payload (Mirai)", "value": "eff09f5de25239242d4f087b5fc1c13ea69094812d7e50082d8545b9a0f8de51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293131, "uuid": "2b367e42-f5c0-4237-9096-bc9e611f554e", "comment": "Malware payload (Mirai)", "value": "096f5cd2812bad27d7924859c783bc4a1fba5e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767293131, "uuid": "6c870a9c-f00a-4ff2-b8af-3fad93ebbd51", "comment": "Malware payload (Mirai)", "value": "93035c7d25ab8ecbf32d5d91a89515dfeaf697a9642d6f647d7eff707616858e58954899aac31525335174db0b6d5959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293131, "uuid": "3ffde8f3-5fac-4ae9-8ae9-c75c36fae19f", "value": "T19A145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293131, "uuid": "ef7ef9cf-55f6-4334-82f7-8e2971445e10", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXVUaN:HZ15BTYCrYq1QDY6G4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767293131, "uuid": "1462d0cd-af19-45d1-ba6e-9888750aac52", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767293131, "uuid": "b088d229-fff8-4b57-865d-fe3212e2e0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767293131, "uuid": "5ce3aa48-7fb5-4ef4-919d-7f1f3574a2ef", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f711c05e-e6f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767262171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262171, "uuid": "e6b8277b-5dae-47ca-bd2e-e961552e5d47", "comment": "Malware payload", "value": "6ab418af84dedce89b890a2b2a50914c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262171, "uuid": "8b519019-1b60-4b1d-a040-a380b7fa4942", "comment": "Malware payload", "value": "f0739c2b8f687587c3683d39ba7bcaa8af4a8997adbe7aa6976c91fc34c4ce9f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262171, "uuid": "9875797d-e0b0-4399-b224-046d5e1d7cb9", "comment": "Malware payload", "value": "c57a51960f50faaf00ba7c09bc45e82c66b8d4b2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767262171, "uuid": "f34f7dba-613e-48f7-9504-96d784a637d0", "comment": "Malware payload", "value": "ef34c089cbf65bae5a0996b04e8c66e6c4d942f6d60905f74a82a0649f3b86f56092949ca265523263a5de2ecf51ac42", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262171, "uuid": "c8d01d1c-7c0b-400c-85e4-ef880ef7c0cc", "value": "T1FC9612C1AFE88927F8B25B3954F5EAF32A31FD916E6ECB8F9A14144D04723449D60336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262171, "uuid": "c75ca1f8-d02b-4838-bc15-27506a254ba1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262171, "uuid": "e8034ab4-4aa5-4c74-a2e1-ee97f0e428ab", "value": "24576:QIZ7bSw98DrZGZN2s29azRdIgHHZodUvPLEDH1AgAa3zIizJzwOA5byy80:QK7bSw0ZGZN28FvnIUnOGQzwdDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767262171, "uuid": "6b12becf-50f7-4bd7-a9e9-7c1abddfb1e0", "value": 9449576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767262171, "uuid": "76412488-7e17-46c4-b45a-cfc7615fd964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767262171, "uuid": "6c564959-7ff8-4821-b1e0-a1918255067e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b959a15-e6a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226638, "uuid": "fddbcea9-d975-4687-88af-b83d7ad9a3b5", "comment": "Malware payload (Mirai)", "value": "e187d0fb8cc7f48657c33e797d98f5d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226638, "uuid": "7a324148-4232-45d6-900b-a8e88134ba65", "comment": "Malware payload (Mirai)", "value": "f09e7b961a348086e405a2a86411333a5eb4e0ceb0a166cfa8d94c41c764aacb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226638, "uuid": "1d98d0ae-b2c6-47b8-90cb-4ad8648e8416", "comment": "Malware payload (Mirai)", "value": "bea9a6ef7abab3937ccefafd77519fca819f10ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226638, "uuid": "0171db7c-fab8-4d30-a8b9-326d1bfbc494", "comment": "Malware payload (Mirai)", "value": "d2213e2248943b0ac1e01325b2a13461d6048c272d27305bf51c4305ed07e4382336ef5f0ba333105ac57032d14b3e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226638, "uuid": "9774ffe6-5660-41d2-8f46-a1e4ae29a04d", "value": "T12413FA89BC91D916CAC55577BF0E42DC372603E8E2EE73039E14AF66365F83B0A6B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226638, "uuid": "a3a802b4-2037-4320-a77d-9674b86c7f80", "value": "384:PnpegF2gFLwDkLvmAp4ewXUvGWxhZXv1A1irqQgmNMcqr/A4vALkMk6DuSVZoBzA:Pn9/+UtLK1irsmN7u/lBw2zixCgu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226638, "uuid": "43f1a0ad-cc0c-412b-b722-84d3de4e2bb4", "value": 42652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226638, "uuid": "29ac0f73-274c-4b4f-84df-a082b250af09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226638, "uuid": "0ef94129-ef9c-4661-bee2-ff6f521e6545", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b793c5d-e6a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227550, "uuid": "2b23f3e1-d850-41ad-884d-13482eaf78d7", "comment": "Malware payload (Mirai)", "value": "9623beb41fa1449005f1851d4d2845fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227550, "uuid": "493d4939-9d62-497d-b8b7-e412a3d0c8a6", "comment": "Malware payload (Mirai)", "value": "f25d0ea5b08108e01a67afbdb04eee35c2e51065d2fdb90090eff9342f01fbe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227550, "uuid": "179ebab0-5104-4d58-8f99-05334b94d942", "comment": "Malware payload (Mirai)", "value": "7f1573b50eaf1a937c164ef93f5a780f8f8f50ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227550, "uuid": "05af1776-9c5f-4530-a7c8-11fca51f88f6", "comment": "Malware payload (Mirai)", "value": "355acc27bb0f45cdc562a5e0a51e6034e4d01c0491be7a6ad22582d70b310890ccd01ee7f6de3bc0514cf30791c5d06c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227550, "uuid": "ad64002a-1f55-430c-a27f-b1bdafae1201", "value": "T1B543A609BB618EABD86FCD3745BD4B4524CC920732A83B757574E428F35A18F4DD38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227550, "uuid": "a02e806d-0da3-4ec4-b977-642ba37f612a", "value": "1536:u47fuCr5YaQltO6CXclcwykJQoGl/hu+7RH:uIjdElzxGhu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227550, "uuid": "81c3c0ac-08ac-4517-8264-025cae094bba", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227550, "uuid": "a04f503b-b469-4f6e-879b-5012acce763a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227550, "uuid": "8ef028a8-60e6-460f-a363-42f31e2a5c14", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfea4d1-e749-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767296351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296351, "uuid": "9d1c81f4-6d19-4faf-baf3-4d38d6984c39", "comment": "Malware payload (Mirai)", "value": "0ac167fd3c35220116911975ecf531b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296351, "uuid": "a85ab5ec-4f4e-4550-b045-4e58a05ada13", "comment": "Malware payload (Mirai)", "value": "f28830a1655b456e7020fc5fa19a90945456fcb18effb44ea6ad6d128c7a17d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296351, "uuid": "7fec8c06-dc1f-4092-bb2c-be7c7ddde6b0", "comment": "Malware payload (Mirai)", "value": "429279f88ddeb874fdb68d6a708b4458251366e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767296351, "uuid": "8cb68107-162e-40d1-90bd-2755e125c65d", "comment": "Malware payload (Mirai)", "value": "ad41eea2b35282d54608df5521367dab39bbbe93559746735f67e874099efbe8c4fd8baee78e24b0169d51f7a23bc5b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296351, "uuid": "76961c95-a07e-4a12-8734-38d842caa06b", "value": "T184D3C021E4006DD1EC2129F578BA97B80350EE700BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296351, "uuid": "e4fdd360-d1b5-4429-a72f-2c1a8a5b1ad2", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xB:PiySSGp+PMmT7zMplP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767296351, "uuid": "6a634a9e-ed9c-4bc8-8380-3bc7f4ec9eef", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767296351, "uuid": "aed00478-3eb9-4dce-a4ae-827304f9811d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767296351, "uuid": "e8761996-98cd-4d7e-8450-1e7c5d18900b", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3922509-e722-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1767279774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279774, "uuid": "7d492c28-480d-4e06-a8a6-445b7775ced2", "comment": "Malware payload (SheetRAT)", "value": "3d73bcd843bac18ec97e3dcacd430340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279774, "uuid": "46deb09e-31ff-4cbe-9c9f-d5c1213e3ba0", "comment": "Malware payload (SheetRAT)", "value": "f2f22e021d8a020b36f82d69a0e549c1f4cf3124a4567884e79aa6bb6405fb3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279774, "uuid": "1c6f5c77-c14a-40aa-bdd4-0b33a93ef182", "comment": "Malware payload (SheetRAT)", "value": "9e5740cf202f06440375fa240699b1a1afd0b631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767279774, "uuid": "a37e9cd5-2e75-4114-bec0-66d44c17fbec", "comment": "Malware payload (SheetRAT)", "value": "b70396d049e6f5afdce98df7690c16ea783c12ecd71bdf6f2dda58b701168381af311cd8a5a211e0de056cc2523974df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279774, "uuid": "4a3f64cc-b860-445b-9a09-3a08fc85e168", "value": "T1A6C44C246FF5A54AE4585B3D429A0510E7BA51E12333734B371BBE620D00BCEEEAC7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279774, "uuid": "2f18f073-7748-4fce-a7ea-75b1b3a601ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279774, "uuid": "b1279c09-b90a-4433-9034-29f0b1be6266", "value": "6144:0QQvH81N/EDThARAsufgkb1dYxkiKdFLhrqBNL1nK5LaL8C3zmGkY8OwbnWe/2ZO://ED2Rr1KhaIszoL/2+6siDPQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767279774, "uuid": "36516171-c74d-4595-a1e9-298ca58e3c5d", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767279774, "uuid": "c8f899ac-74cf-425b-882e-c11b3d7c159d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767279774, "uuid": "2df648e6-2fb1-4cf0-88c8-3c0cc1933897", "value": "tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9364b50f-e727-11f0-a129-42010a9c0007", "comment": "Malware payload (Koadic)", "timestamp": 1767281761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281761, "uuid": "52d7a242-3c7c-423b-a8e9-e1425428d974", "comment": "Malware payload (Koadic)", "value": "730dd1186d60af43c5c835e52707d963", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281761, "uuid": "a228929d-e2d5-47f5-9401-45f901171f70", "comment": "Malware payload (Koadic)", "value": "f34c5bb21851a7aae267a734b7203c42df6280d4ce056a18c3bab5cb028d60ca", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281761, "uuid": "03b30ff4-2395-4bd9-a081-b0c2f565114f", "comment": "Malware payload (Koadic)", "value": "10d50ab5098bfc776a5ada30c49aa71c0d380b04", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767281761, "uuid": "ad100843-fc5d-4654-8cdf-643e7b79c0de", "comment": "Malware payload (Koadic)", "value": "db1684118f2e4b1a8b2f4fc9e75e8e14aad511afdfa8062664330002d170e4e3bdbfa5ac6eb73643ac27b6ee92fc304b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281761, "uuid": "f5554136-643f-4a6a-b1d1-8687f3dc1e6c", "value": "T18673DE380ED30BCFB128E45F678744221DABE93F5875B4CF90D43A7A2AD5B58710B869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281761, "uuid": "164ce8eb-2bb2-4e4a-b9fe-9a8995980d39", "value": "768:G8l0WmN2eWHPX+yJhAoEBRt+3UtqosyiHD0fMxFExvttSpsIIczgFHb8suM:Lm+PEBsoVVfMxFExvtIIOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767281761, "uuid": "b97fe774-2c7c-4524-adae-c150325787fe", "value": 76222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767281761, "uuid": "ab492efa-1049-43ae-bdda-0651d0b18a8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767281761, "uuid": "9f02e371-9d28-4d8e-a17d-38ce1a19a762", "value": "update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0f02ae-e729-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767282498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282498, "uuid": "81cd4359-338b-4c5f-9a3e-9eab95b00807", "comment": "Malware payload (SalatStealer)", "value": "c3eac56d8ed200615798caafcdbf8266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282498, "uuid": "5d4d0ad7-26d1-4c63-9125-a383f7a87563", "comment": "Malware payload (SalatStealer)", "value": "f386f87e110a22c61f19cec5ba497f2dc8660e2c39d9a85e5f4a9c486268f9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282498, "uuid": "6b89b1e7-55bf-42b5-b3e5-e3803d90a95d", "comment": "Malware payload (SalatStealer)", "value": "299b05b74bd110faf71535d55a483b24830b571b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767282498, "uuid": "e15683fe-fdc8-4529-909c-588ec0aac1e7", "comment": "Malware payload (SalatStealer)", "value": "eed0e8ccdc997e8598de276072801107483e84b803e9368fc2e7c04c9d56bcff55cb43a75960e405d3b3b4866756988c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282498, "uuid": "236ca9f2-87f7-4cef-9c07-a8793e440a77", "value": "T163C65A51FA8B54F6E9031831405BB23F63305E048B28DBDBFB547B6EFC7768119AA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282498, "uuid": "687a19ea-4e12-43c3-a9a6-51e434096114", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282498, "uuid": "1d9aa6f6-2126-4ae1-a644-0f75e8676c15", "value": "49152:OS48oCBn/+77wv58YTQgzuQ84PEC8aVQOflhkyBkNu6HNZgLaMmKk3B+hpubFZ4i:FHoy/DSjKVeCRrVk5EQ5nvUvnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767282498, "uuid": "8bb419f1-7ec3-41fe-ba83-ccc3225a9404", "value": 11656704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767282498, "uuid": "29964b33-c0f6-4199-8dc7-b57d3b46ccee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767282498, "uuid": "34da02c6-30a6-4351-8d4b-a73ef52b1c65", "value": "spectredex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94333d2e-e73c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767290781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290781, "uuid": "15d54e5c-8444-4110-b6e9-d79702349c55", "comment": "Malware payload (Mirai)", "value": "f4419f64c1585b05be8813177b7cac5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290781, "uuid": "8e5cf769-f0de-43a9-bcbf-cdd1301265ce", "comment": "Malware payload (Mirai)", "value": "f44aebd5b2a9f8e1d9e992a1e8726f451f7d7ee9c773965a8bb9e0dd7e48bd89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290781, "uuid": "25d86f53-a625-41ba-ad4d-4e0489b406fd", "comment": "Malware payload (Mirai)", "value": "def79488d87a1118135e2690ac5f089c6d6cdc90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767290781, "uuid": "7ff07670-3494-4379-8cc2-50eed8734863", "comment": "Malware payload (Mirai)", "value": "78b46ab890510173c521bbfbfa93de251146eabee2611848dd8c564ec2a3a41eeaeef5c86c16d387346b58b815dd6ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290781, "uuid": "7de41521-51a1-429d-b88b-cad19a362287", "value": "T10F437D62CC6A2D58E55488F5B034CFB59B63D414918B1FFE16AAC27D5043E8CF14A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290781, "uuid": "e28efd3a-7dbd-4183-a728-9ffd8d673e0d", "value": "1536:h76/PVOUB/V4buSQRKFSuLv7mLDxHCe3XO:hu/uFlADxHxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767290781, "uuid": "f41ba2e2-34f2-412a-9022-814e0bfd81ec", "value": 56992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767290781, "uuid": "52277bf7-d8f4-4b70-8313-e0f06a00b8dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767290781, "uuid": "6ac404e6-d3bb-4dbb-81d4-6ded40314cca", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319ab75f-e73e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767291475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291475, "uuid": "ad45f27a-414a-4f48-8213-d9bf84eac18b", "comment": "Malware payload (Mirai)", "value": "c374fa046d7782a721d0b2d51e0699f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291475, "uuid": "6c2e0800-c1f2-4f0d-ae83-ae9343fe7744", "comment": "Malware payload (Mirai)", "value": "f4da8d39e339c0a253bd7fdc5b6af08498492d54500a43fc1b278807a480e608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291475, "uuid": "17e37aac-0a93-4f36-8203-5ea32e6de2c9", "comment": "Malware payload (Mirai)", "value": "cc9f93f6198823c407765a2b8726ca5ff50e0cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767291475, "uuid": "58c46391-8496-46c3-b6d7-24e8c0ac36c5", "comment": "Malware payload (Mirai)", "value": "9903236832e89d57b8e9ed49f6e120196b857549207bf8158fcf525ed1c54374f988492cd8180fb915d600c5ef18e9d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291475, "uuid": "303381cb-31d9-452a-9325-d12efff6a783", "value": "T10CB3E095B210AE45C02672FCB187099093B17E7B4B9A150B8473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291475, "uuid": "94e2ce64-bcec-4992-8fcb-daae41f82cb2", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuc:as5zqhr5Nzy7wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767291475, "uuid": "36e9ca5e-8185-4871-9c0f-b6f200340995", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767291475, "uuid": "3bcab60e-4eda-4996-b912-696696a3b997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767291475, "uuid": "18a197a7-66d1-4858-88aa-a305523900f0", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e567de1e-e6a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767227352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227352, "uuid": "4d4df9fb-303d-4ded-9a1b-6e3f50e60427", "comment": "Malware payload (Mirai)", "value": "da462232be9ae794f19291503cd0a39f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227352, "uuid": "de0005a2-a769-4feb-a740-5d6f83d3f1a8", "comment": "Malware payload (Mirai)", "value": "f5aac0811c337473bc3012d777931db1294cc1d06baefd410ae5cfa545fd4540", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227352, "uuid": "566647b8-259a-4d4f-98ae-879e34c80aa4", "comment": "Malware payload (Mirai)", "value": "f0441836b26b4b1c287f37b101a7f2c6c16d4a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767227352, "uuid": "58b2bd7f-ef84-4dea-bcac-340a8dcccaed", "comment": "Malware payload (Mirai)", "value": "2551956a3345291a9d88b9257730cdebedcbd9d8c500ef0a605b99a96de8cfe0847ef8029034cc7003d1532b32ed7921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227352, "uuid": "474f4801-0285-46f0-b15f-5aae15291be2", "value": "T117438D33C43AEDA4D18885B8A9B18AB91F53B200D6522FBB5E85C5654043EBCF60D7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227352, "uuid": "c27db866-9cfc-4b26-b61b-9faccefaea96", "value": "1536:qaxwtGSPHQ+gHJhhdORiaHUAaCenCY3uM7R:qC+PPCJhLORilAaCenluM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767227352, "uuid": "8494ba0f-b9e4-4976-8697-83519655e1ec", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767227352, "uuid": "031e8290-6a47-4079-a5b4-fc854e700457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767227352, "uuid": "f64476c9-da98-4dad-bacc-f800d436fd6b", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec727b4-e6a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767226133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226133, "uuid": "9ea23eda-f8a4-4031-8b30-0be6e2613a58", "comment": "Malware payload (Mirai)", "value": "6adfbbdd6ab7a89068a666e12a28418c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226133, "uuid": "aa5d598f-a76a-480c-a7b0-abc89807e676", "comment": "Malware payload (Mirai)", "value": "f5fca318a1f578f2b29809ebe35630965b68cbe02d8a10967681411c23e6955b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226133, "uuid": "282f6587-eb98-4c16-ae24-fd4c69539b57", "comment": "Malware payload (Mirai)", "value": "46c7935821c71f70aa15e605e7dce3a689c0abc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767226133, "uuid": "87135a95-457c-4237-87fd-d7402a39613d", "comment": "Malware payload (Mirai)", "value": "f25845557855b7f15c81ededc4bc0979b8af73a5a4938557a1b1d90ee7c9fedc3a02484967fbdb7186d43fec58f28c5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226133, "uuid": "7057874a-f10e-4f51-b486-ba380872151d", "value": "T102242B42F9418E12C5C112FAFB5E518D37136B79E2EA7202DD24AF60378A8EF0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226133, "uuid": "08d2fe3e-6fd1-46ff-88bc-f6696e8b9701", "value": "6144:x5m/1k7VmpBREHKVAbW58fyexfKNwODuxEHK1gj04zRXP7maUxWxBdYZltfjW:x5m/yhKREHKVAbW58fyKfKNwODuxEHKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767226133, "uuid": "31f51cc9-abad-415e-9c8b-90a59ab1bedc", "value": 221468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767226133, "uuid": "73925efd-5bef-4176-a0eb-b2dbbc45d2a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767226133, "uuid": "b0cb75d9-ae13-4db8-8b8b-6ba129b78f16", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda74196-e6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767233298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233298, "uuid": "6cd869f1-7097-4ae0-882c-76605ca7b7c0", "comment": "Malware payload (Mirai)", "value": "06527fc4a0f19c6505a0cff8a5a5f327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233298, "uuid": "b841aab8-106c-430f-9137-e9594771c4b3", "comment": "Malware payload (Mirai)", "value": "f61586792063a9038ee051bcb49a2491dadf92740a43c36705842714acab4c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233298, "uuid": "a03e2e73-8db8-4873-9300-19543f2161c0", "comment": "Malware payload (Mirai)", "value": "6d0c7dd0115a50724712f69365d3a33236a91f02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767233298, "uuid": "f66ba997-cf1d-4ab5-a6db-f4d52e9596b1", "comment": "Malware payload (Mirai)", "value": "7125378d71f20701f094062b6adbe4de4e01c566e1412e12af5e230580d16fb534315cf214db60ef403c0c7f5f1ea433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233298, "uuid": "6f7843a6-b062-4351-9a64-bee119e561e3", "value": "T1E6A2D020815A6651DA310D37EDFCC4D3770707F6E2D331BA3555A9BCF29ADCAC2A8192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233298, "uuid": "e1b39bd3-b79e-4b77-a5dd-468a7379c00f", "value": "384:gD+6iwZwE0tYdHKWyp2OgjdRKHdEw9AvkNar44pIhymdGUop5hXO:ga6PZwFtkKWSe3edEYM44Ws3UozJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767233298, "uuid": "8eca1339-9aa7-41cc-b4f6-ee99b4ea58a2", "value": 22252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767233298, "uuid": "3673a058-5139-477a-9f9d-86949abe65cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767233298, "uuid": "4b1a5180-0b52-4eee-bef3-fbc46ffac97b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9cefb3-e6b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Ligolo)", "timestamp": 1767230986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230986, "uuid": "c1de0a45-768f-4b83-9806-c459b3ceb972", "comment": "Malware payload (Ligolo)", "value": "a18e5bde2b4fd9a84333f2f7c24b1d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230986, "uuid": "e7467fb4-1603-4a89-910c-b5b063b0f802", "comment": "Malware payload (Ligolo)", "value": "f6fdfedea8efb0eb9b409267ea545ff09272c9a6ba59d9ffc9454c85c70deb18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230986, "uuid": "e187e80b-0d7e-4561-8dd7-0e275adb125e", "comment": "Malware payload (Ligolo)", "value": "604b162d0c9d0c3eb8111bae0e4ee604e3a31f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767230986, "uuid": "7c9ba367-963f-401f-a05a-1e1a05f5addf", "comment": "Malware payload (Ligolo)", "value": "1510eb6b86e0f5309c7c9af8f27a7f197b5c16dc363d84628216c353ee80c4a26e848a18349ef39257700e734b01ab4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ligolo", "colour": "#349880", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230986, "uuid": "3f353f00-ccc6-4a89-aab0-ec556bdc5580", "value": "T1A8768D13EC9159AAC0AAF23189729253BA71BC452B3227C72F90F7382F737D05A79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230986, "uuid": "5510c868-b9f4-4d99-ad5b-9c049fa27b7f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230986, "uuid": "869bad8f-eb01-4f22-8891-a1f8cd1d86d5", "value": "98304:fOjo5IXAIYIffV3dEIlUZznde9FCrSrOW2:fOjoIXDJIIC7de9olW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767230986, "uuid": "6d735c72-0df7-4b40-a2af-867268f9f743", "value": 7192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767230986, "uuid": "3b6adc94-3f21-48e9-a399-c61c20901c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767230986, "uuid": "2abb780c-a8cb-446d-aa6f-37a35b4e9564", "value": "SecuriteInfo.com.Trojan-PSW.Agent.8047.25462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70df910b-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767295447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295447, "uuid": "989f8465-fe59-4883-b324-75d64e53dc0b", "comment": "Malware payload (Mirai)", "value": "e10e5d3bdd5e456c93ed11e90ade95a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295447, "uuid": "171a2503-7885-4bca-bd35-754fb6b57082", "comment": "Malware payload (Mirai)", "value": "f7b0ecda208ddfc12cb2f40b8ddaa0e9f7268701cf886d403b31e5a83fc45c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295447, "uuid": "3069765f-4156-4190-86f3-d81d712b9c07", "comment": "Malware payload (Mirai)", "value": "d87c7e628d937773d09e72e05db001dd6c9256dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295447, "uuid": "385b843d-ef73-48cb-85fb-f3bedba6b5ff", "comment": "Malware payload (Mirai)", "value": "812035da179d0c034f1a6cf4b59b413b566751378a481b833b6227daacd287ebcce6dc5a0ab04969251d2be4b5a4469c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295447, "uuid": "36cc9671-d393-4d03-926a-8234e0a34839", "value": "T1C1931986B8829B12C5C512BEFE1E118E3313177CE3EF72129D246F24678796B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295447, "uuid": "df1d88f9-9977-44f6-bd73-64a50108a743", "value": "1536:mvnRhAXd687Cl3EVbhODnpAFaW45i80eEYYZcDraQwH4Ear0QwidWPfR51Za2Sdi:Qid1CqVbhODn+aW8ipeEPcDraQhfWPfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295447, "uuid": "d0a7be50-032a-430a-894d-b30086b54465", "value": 92288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295447, "uuid": "4972a8cc-4471-446d-8f90-ecb8a3044437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295447, "uuid": "f918bfcf-1ac9-471d-8cf7-d67c09e81301", "value": "goon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf88f19-e740-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292378, "uuid": "21a50ded-936b-457d-8d7c-35d9181c909b", "comment": "Malware payload (Mirai)", "value": "bfc1023870668858525638b8dcf048c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292378, "uuid": "e2da2843-f132-414e-896f-697c3e896d28", "comment": "Malware payload (Mirai)", "value": "f8060347034f4b233a1e1c1ab468badc9477de9c3ed1de7a2ed25f5dd8ce29f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292378, "uuid": "b5b47048-cd30-41b9-8847-86c2559bebc1", "comment": "Malware payload (Mirai)", "value": "73e3f9a4674cd71cbb0d85839d74f2c27c8e6c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292378, "uuid": "4e37c41e-8da7-4f5d-94fd-071f020910fa", "comment": "Malware payload (Mirai)", "value": "0de270b8ae6205520e0c08a6a7787d16b60269a904facd421de60af4d445ec955f49b3f13a5a7fba3cc328e665b1dfe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292378, "uuid": "7f37a913-29df-4e6b-9deb-7292ace39118", "value": "T19E63026224D9AD84D13A93322C23EBC1D5006B993216B4AB7CD93E6D3DC6FEB37251D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292378, "uuid": "866c9e39-1bb7-41a5-8580-bff5639aca76", "value": "1536:rI7YcyLC1AZp7i5zmpFyZfZyA41/dwRm5DFJFFb6aO6v/H2lnouy8Gyp:rfLtqzxZyH/OmFJ36r6XW9outN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292378, "uuid": "2fbf3087-b4b0-4491-a0da-330fd8e7bfc4", "value": 68628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292378, "uuid": "30287050-bce0-41a0-a683-6879debfcee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292378, "uuid": "8e73a30f-d578-441a-bf93-cb47518b5fdf", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accc1e62-e736-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767288246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288246, "uuid": "7a6806b8-4dd7-4b39-b05e-008f3abaa1db", "comment": "Malware payload (AsyncRAT)", "value": "80fd79ea65d675777b33248f97f842ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288246, "uuid": "c3ac8ee2-985f-460f-96b6-eb6431bab5a7", "comment": "Malware payload (AsyncRAT)", "value": "f838923d1d78e90dc5ce619d02c4afd0abae854433f9a140063e1e16934ecb1e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288246, "uuid": "0343a7b4-cbe6-42af-a77d-8978d80bb474", "comment": "Malware payload (AsyncRAT)", "value": "1f1b5225ee10702e9504e87e73099e3f29aef284", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767288246, "uuid": "2c909f71-fae5-437d-a421-5d25eab558fd", "comment": "Malware payload (AsyncRAT)", "value": "1fef3a63d626d1bd2513985c31ed0e86b4a41c5319623a29226015c713920321384f1a109a35d7c520afb5bf43fb1049", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288246, "uuid": "baac8a46-fbae-4b9c-b597-6868d4cc9ff5", "value": "T1D136224F07700FC7E0060F70EEA0CDB79C7BE8B62E0B5E55B25857E50626716A847AB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288246, "uuid": "d0527683-7125-4e6b-a883-bd1f0bc79181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288246, "uuid": "85d442c4-5ebe-46be-8d69-41d04a417b3b", "value": "98304:7VxKY0GF2f1kSgTh+53wjGBmuLNwKyeJZTPYxGU0:7p0GFQyAFwFeXPYY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767288246, "uuid": "8a8eedff-3dd0-4ba5-8420-75060ef0853c", "value": 5043712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767288246, "uuid": "f2b8f873-21c0-44d4-b8db-c726162ac394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767288246, "uuid": "73405d3d-6bbd-4386-a11e-f6e86431df95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3026be8e-e711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272145, "uuid": "e1358912-cec2-4a61-901a-0d6df6eb59bf", "comment": "Malware payload (Mirai)", "value": "b2c3edc59113e881b6dd5667b7161255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272145, "uuid": "aaaafbd4-9fd2-40a7-bb2e-c5b78f1a5d8a", "comment": "Malware payload (Mirai)", "value": "f932b48dcaf87ee65ba7a07025ec272470d00797d63c02728c7784069b1d451d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272145, "uuid": "7a26264d-b9c9-4613-aad7-dcf556a3a32d", "comment": "Malware payload (Mirai)", "value": "013fcecd8748750adb3cb863a0c800651fb16b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272145, "uuid": "07f6d05b-5404-42fe-8cc1-77361980a240", "comment": "Malware payload (Mirai)", "value": "1147d2b5ccec071a8e7832ef92ef548b719c3b94dd2fc8f934121552cb85a2c9e151ef572c73f4497901d0b926c0b800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272145, "uuid": "0d08a200-969f-41f0-9fdb-107edf1ef23e", "value": "T16954E852EA416EBBC00DCE30051F878922AD849D43FB577BB278C55E7B8EA0D6AC7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272145, "uuid": "f966d4c6-b5d9-4f81-838b-513c915490fd", "value": "6144:uEt/rKEAJ9zw27FVon9vIQZE0y6iyq1WyUeUk3cNVRIyybW:uENuEyNUk3cNVPybW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272145, "uuid": "4a04613e-e775-4835-9cf5-67a2c463307d", "value": 291280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272145, "uuid": "339fae67-3bc4-49c4-85b6-67eee9ebe036", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272145, "uuid": "cb6a682d-dcf8-4158-b5fe-5a908c492f61", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338e2081-e6f7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767260984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260984, "uuid": "d0d7b2cf-365f-461b-9c3d-599ef02729e7", "comment": "Malware payload", "value": "d3a6a731efae51a6c4d2534e4682ffd9", "object_relation": "md5", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-Wolf", "colour": "#BACDA5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260984, "uuid": "7325aff7-5c84-41da-ba40-68323d4808be", "comment": "Malware payload", "value": "f936f6ca0b3e7dcb347e0487cf2453af8a224fc801f33a840bf2a00bc42e77b0", "object_relation": "sha256", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-Wolf", "colour": "#BACDA5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260984, "uuid": "8edb2949-9a41-4dba-bd43-5b5a4004df85", "comment": "Malware payload", "value": "bb0b0ee0afc04b1784d220f8f8ea061794ecd863", "object_relation": "sha1", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-Wolf", "colour": "#BACDA5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767260984, "uuid": "d8ab0e92-dcf2-408e-913a-1275c1a01fb9", "comment": "Malware payload", "value": "105c96dcc898fa6ac023e93d8f845a8be4f914a52353804310e8d56111b9f5e26155cd70e4239339d362356d26e3dd2f", "object_relation": "sha3-384", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-Wolf", "colour": "#BACDA5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260984, "uuid": "032ac3d2-d3df-4d12-8ec1-5370be59d3a3", "value": "T18EF47D1AEBA910FCD1B6C139C9424026FBB2BC5257619BDF13A0279A1F3B6E45D3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260984, "uuid": "028120bf-ec8c-43df-a112-8b0bb4d82f56", "value": "9d37453b83c4f2ff30207e59eefe9b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260984, "uuid": "2f4b1dc1-0d33-4980-815d-224d0e1ca72d", "value": "12288:scxm7g42lPPUI7WYgeWYg955/155/iclGcfVCqUdw3s17wHo/vOEQz6OWt4:rxm7g42lPPUImlGsCqUxyXi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767260984, "uuid": "5d07b234-8f39-4579-b9cd-2a4bf2e0a9dc", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767260984, "uuid": "e1bc7275-893c-4f24-883b-de97e4bb21fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767260984, "uuid": "fc7ce00a-26c2-404d-900f-4329b8c2c829", "value": "doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afcd4f7-e747-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767295410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295410, "uuid": "18808622-23c3-4bde-90b0-b870184486a9", "comment": "Malware payload (QuasarRAT)", "value": "9ec63c1aed7b2fad31a3b9daf44b2c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295410, "uuid": "ef98d691-034c-40c7-8c99-64ff7856b4fd", "comment": "Malware payload (QuasarRAT)", "value": "f9784c57a81fd0e2ca5f11c3295a537d005167f65eb0ac9cbeaf5757cf6234e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295410, "uuid": "1f6ff9dd-2fe0-42c9-83ae-009fce6e49d2", "comment": "Malware payload (QuasarRAT)", "value": "d3d8eb17941c9dd24dd277a25e3a35fd1d2ad14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295410, "uuid": "62b2d0ba-5cb0-45c5-a48d-c655041487c5", "comment": "Malware payload (QuasarRAT)", "value": "278185981014aa8f217b9e5d8fdf311ae7ce3caf0a5b973f75823585aae26729c0b2b311e18b5e549b0eb50f252c2936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295410, "uuid": "fda77cff-947c-47ee-85e4-af3b8cde8550", "value": "T186E55A1437F85E22E16BD3B3D5F0502763F1F82AB763EB0B219167BA1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295410, "uuid": "dc239ba8-0bf8-4131-80d0-1cb4ebdfac1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295410, "uuid": "2fa251f7-249e-4ff2-93a2-5891b5f50614", "value": "49152:kvFL82kyaNnwxPlllSWxc9LpQX4Yt/NBeJLoGKFPTHHB72eh2NT:kv182kyaNnwxPlllSWa9LpQXd/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295410, "uuid": "66dd2959-2094-468d-82bd-e53dfc9073cb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295410, "uuid": "d4a2a230-642f-430a-82f1-2aceceb07868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295410, "uuid": "9046641c-e5e9-40ac-966d-7410cab0dfb9", "value": "MyApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7b29ac-e6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767250607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767250607, "uuid": "e4e86a96-5b33-41cc-896f-33b366f55533", "comment": "Malware payload (Mirai)", "value": "cd373caaf82cea7d777f73e9d4ad1541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767250607, "uuid": "995a9b6d-6678-46fa-8fce-0f896c568038", "comment": "Malware payload (Mirai)", "value": "fa6a15d5310544991c512318f0af5839086c3b0b8b862af9bb96d46cd5372c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767250607, "uuid": "2ee221ea-9006-48ce-a618-11d093797f8c", "comment": "Malware payload (Mirai)", "value": "3c23bece8c034fab739ab9d739efb35c2e904a25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767250607, "uuid": "b5c7e407-6ef3-4ed5-904c-a70fe6b95599", "comment": "Malware payload (Mirai)", "value": "722c2c5fd27a7cf9122c7fea0ee313c8f8e25cf5abbfb0cb82ad314da3d1c6b5c99aafcfdaaebb740531e06ac84bbc02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767250607, "uuid": "43c99478-f046-4e8e-afa4-feada3cfaecc", "value": "T1C753AF77C82A6E98D55981B4B8708E7C1B93B44481470FFB1AA9C67A9043DECF7093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767250607, "uuid": "25aed89d-82a9-41b3-b80d-5aa5741079fa", "value": "1536:cqwtPwlFIK3lQLaPK7v5fWXVcxCF041V62:cqDl6K32LaS7cFcxLyk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767250607, "uuid": "73e46049-296f-42b2-9942-4843b9307ae4", "value": 65368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767250607, "uuid": "d291a18d-12a5-4fa2-a441-4e4f97f042da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767250607, "uuid": "9644e40b-9c65-4a29-b836-76cfa7921aa3", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2a3bab-e73a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767289773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289773, "uuid": "77f72ae1-dc9e-4283-a68b-b735d9effb1c", "comment": "Malware payload", "value": "2ab16c00115bef2b1e67d46e24f1cb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289773, "uuid": "06ac58e5-37d7-46db-bc18-4227e4c68428", "comment": "Malware payload", "value": "fa8135a20526820d46d7c0ec9d1c200d1f0216df691b2109130447b949c8d5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289773, "uuid": "f4e53f00-b2ed-47be-83d7-5192b2d39571", "comment": "Malware payload", "value": "42a46496ac1804c8479ff6a0a37c6df1f0243470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767289773, "uuid": "03743b9d-51ec-4858-b7d0-48500ca7396b", "comment": "Malware payload", "value": "935a7a108ed736c613574bdee3cd89eb1fc26da99d5c2e813cc1f8ea3b6467b625522b0e7dcefe0e45158f4adc8153c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289773, "uuid": "2364b330-e3e1-41b8-bde4-3fa720892e55", "value": "T1DD374C9FD26102C1B87AC2756940855FDA0EFD38CF00DD03B03EB596C6B9ECA756AB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289773, "uuid": "613b5391-8ec7-4819-ac1b-da5d5fbe7c4b", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289773, "uuid": "1f2214ea-8644-4cbc-a8e6-2890be6e58df", "value": "98304:kcMI4PpkT1ewoBrjj1sNJ4p/EPjofdqQkHYkWsBK6hNUJi:zh4Rc1IBrjj1sNJtof+HYEhNUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767289773, "uuid": "991e90ef-cc0d-4e48-9729-3f41a851d9af", "value": 22971904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767289773, "uuid": "d50873d5-3cb4-4613-a463-8e4f225004d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767289773, "uuid": "4ee74e55-3dec-4402-848c-4c7fa9e237e9", "value": "Kiddions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597d60d5-e712-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767272644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272644, "uuid": "e4953f17-5632-4de0-9d7b-b7a09795a592", "comment": "Malware payload (Mirai)", "value": "0f740e490e5440f222dfb0567b65b69c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272644, "uuid": "ab2dbdfc-bcb1-469a-8c02-1b081640be46", "comment": "Malware payload (Mirai)", "value": "fc59279347bfa145cd9f24422af7e40d747b41b148f6689f4d49cd8193a9491c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272644, "uuid": "3bf3d914-8639-4e7e-a2dc-e1778743cd1d", "comment": "Malware payload (Mirai)", "value": "0a9c03eaced84a8f62661e9bff3163bf0ec843c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767272644, "uuid": "2d3faf40-1937-46ff-8f6d-0b24ff3c15fd", "comment": "Malware payload (Mirai)", "value": "3fa493879af2bc112e2d5a788c7e43ee07e5ca27b30354254f89efc98eff8ad19677a8bc61a0ed67c1b4ba0b45f7407b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272644, "uuid": "202eb9d0-d4f9-4215-a0d9-7db755a77f28", "value": "T1B3145B66BDD2DF11C5C011BAFE2E518E331317B8D3EB72169E102F21678A96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272644, "uuid": "3f03a2f0-7469-4bca-9761-de57d8628a51", "value": "3072:iCfqrPHss88d1qx47ogbxHsBpKxpY12mMZF2UCw/zzlrj+5Voh1ziaLMhzS6KUW4:iwmHV8a1J7oSHEp0Ykmx0zzlrj2oj+ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767272644, "uuid": "57465481-f667-4a88-b7be-938b60b59f6d", "value": 192372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767272644, "uuid": "d18350ef-9d09-4288-8664-5de5b812b190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767272644, "uuid": "15414ea2-f272-4562-95c6-1be7a4096d88", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213bad6b-e741-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767292736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292736, "uuid": "d45c6509-eb95-4529-ab29-47855a5a3bd5", "comment": "Malware payload (Mirai)", "value": "746ff6da53c97187d691ac0487249af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292736, "uuid": "43b07418-4d31-44f5-83ba-9c704bfa4af9", "comment": "Malware payload (Mirai)", "value": "fcb7b40ccad99bdc99351a1df9d9b291175a3dfd12ae2a5dfdf158965144735d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292736, "uuid": "838b36e1-d2fa-458b-99c9-ff04960ff1e8", "comment": "Malware payload (Mirai)", "value": "9b271c7bda8faaf3ddf1a43f15964c68e3702bf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767292736, "uuid": "60673426-438a-4970-baa7-58b92e9e6ee4", "comment": "Malware payload (Mirai)", "value": "f9eb45616611f2fc8a35b424bd0a5ab92f056cb46cdf3da0baa1e23b79fe35392165b1deb36ddba2fb89144911d86666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292736, "uuid": "7a8b4b0e-dc60-4377-9f28-170810e4fbea", "value": "T187146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292736, "uuid": "7eeb2210-3390-4bf8-a8ee-e44aa44148fa", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTt6:BZAyFzQSdS7IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767292736, "uuid": "8026a07b-3ab1-486b-8d15-3011cdd690fc", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767292736, "uuid": "c3463724-ab41-47d5-818f-327751c84f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767292736, "uuid": "2a2526e5-8be6-4322-a40c-1e02838744ae", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88b3152-e6ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1767229505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229505, "uuid": "05f2de20-4f4d-49e8-b7a8-309d4ab57340", "comment": "Malware payload (Gh0stRAT)", "value": "586111eef3e37fd93e9d2b5a4370feba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229505, "uuid": "77df8442-e093-4e78-a1ae-6707c0b36b9d", "comment": "Malware payload (Gh0stRAT)", "value": "fd75b79ee8733c0196bc3a89575dc5bbd0f99d075d259db579fdf2416778c4cb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229505, "uuid": "a530b348-48f4-47e7-b066-3ada55e2a4a0", "comment": "Malware payload (Gh0stRAT)", "value": "dab1f2df3ab795197f24393c64698295cb1c1c00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767229505, "uuid": "e29d308a-7928-48dd-a4d2-612bc10c1d8e", "comment": "Malware payload (Gh0stRAT)", "value": "60e244cafbf6b0626de490789c8c099589fad588a1fae67d2b99de08e582a096c089cc84c32e02451978e6fd57eff47e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229505, "uuid": "277e36f5-16dd-4ee8-9171-0cb601a70ce5", "value": "T167047D01F7C901E9E176913C99FA6B36DA3374140B288BCB6754CA991A23AD5FF36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229505, "uuid": "b9682270-bb3c-4433-9d22-490ab385dcb2", "value": "b6fe1394ce89e6c21fe5af76775c6e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229505, "uuid": "bcbd69eb-0f31-418c-9823-17a1aa58f739", "value": "3072:N/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:NLPnc2qrJ51ZkMaJhQCNBU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767229505, "uuid": "66b63f4e-e3a9-4c20-a7ba-4f8dbc401c78", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767229505, "uuid": "3f29eba8-b046-436b-90a4-abdf1200c265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767229505, "uuid": "7713a884-1008-47c8-92f8-1f6ad14c1123", "value": "fd75b79ee8733c0196bc3a89575dc5bbd0f99d075d259.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d0880d-e75c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767304577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304577, "uuid": "511c9c28-89f8-40b3-a51d-51a83e9052f6", "comment": "Malware payload", "value": "d7ad78e12574e255222afa8bb12a2b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304577, "uuid": "e692156e-ef0e-4391-b95f-1ba8afa1c94b", "comment": "Malware payload", "value": "fd7b5fd23aed0b89fefa4a9261154affea7681d51378656088e38bf8cd27faa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304577, "uuid": "8710b3c8-9f72-416b-8e84-7fd01dba709c", "comment": "Malware payload", "value": "ee6cfb3934204b425b90859aaf11699ff76b47dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767304577, "uuid": "387f6bde-9359-4968-833e-a5c33bed0a47", "comment": "Malware payload", "value": "324cd88a177c27c1d7f74fcddf3b1bf29c857c5e12d04e477363ecc723121b4e6e5897c69a9eef70703bb36b4614bb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304577, "uuid": "a4d77efa-7426-4460-b5d9-c2f72e0301d1", "value": "T1005618617F84EE4FD29822348AE7C23473D53E0181F064378616F71D1EBA2B59E5AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304577, "uuid": "af5cdd0c-b0e0-4e13-8fcd-2e26de9c1dee", "value": "49152:7wX0MQmgfTJfYXBz2CcTYfjHLLYxuAKHHEt5EI:caGgs8xuAKnEjEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767304577, "uuid": "9a10cb92-ee0f-4a79-93b0-80e602ee335c", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767304577, "uuid": "dee3ab73-44c4-485e-86a8-6089b617c02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767304577, "uuid": "fecab6cf-6342-421d-bd33-523d6589ab6a", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc63be3-e747-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767295633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295633, "uuid": "14c4c023-ea53-4e38-8278-9e10814dfbb7", "comment": "Malware payload", "value": "181dd71c18af7954f05f0eb001388341", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295633, "uuid": "f593a3bd-8f72-4690-a11f-d8d8c9c99fa3", "comment": "Malware payload", "value": "fda714a2156ef936a25f24b3444f7d1fb0517ec4aaa7a019594b7e3ebb0f5ca4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295633, "uuid": "22d6ac83-fe18-4f56-a246-a066a8e2b013", "comment": "Malware payload", "value": "4ad577ee57168662dd93fb62b315a28bbea9400c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767295633, "uuid": "1504b982-c5e4-437c-ac62-a9673fb53a8b", "comment": "Malware payload", "value": "f134cacf2929508ac93a0672000e8dc3eade9154628fb9aea2e09fde3b3e296ea6a7302a1b9a09f2f79b31d5a077c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295633, "uuid": "f4aa82b8-294e-4b90-9ac0-1960b2aa391c", "value": "T11E01C8FB50F759228398CE8930BA983C5005D5C53EA29EECDC6C04716EC7D2DB126E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295633, "uuid": "f9e69b9b-ba65-41a0-a181-bc6d54f88a50", "value": "12:dUlxJUneKlCnUTiKl2nUMUmUm9JUzFG10JUwYPUkboUmlR:ixulCJKlcBiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767295633, "uuid": "05da0db0-ef0d-4790-be08-ef6ecd9cc48b", "value": 741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767295633, "uuid": "4bf1819a-49af-4f73-bfd2-1fbc2525295c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767295633, "uuid": "b2bd9fec-feb8-424f-9f2f-e205f8bf0899", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f7a919-e72d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767284179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284179, "uuid": "5fe8567b-f273-4c58-b315-dfeaa623474f", "comment": "Malware payload", "value": "39663454e28d91d1c915d7eeac9eeafc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284179, "uuid": "3dfe0985-6c03-4ab7-ad45-80d123d06d00", "comment": "Malware payload", "value": "fddcd6b45203953da2b264965baceefaf44c59e740a4639e3b6590d6b93a56ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284179, "uuid": "6d25898e-8a78-43b9-85c2-142f0fc38b09", "comment": "Malware payload", "value": "f7554445a28998f91d25b55d85c1596deff91222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767284179, "uuid": "34f859f4-4ccc-4c90-8556-a1f03956fee7", "comment": "Malware payload", "value": "f115984b87bbf99c256f4c765cb4abe1d4ea59c23cda89dea9c93fc827b7577afedc2a957d3f913b594c3efd84b6d437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284179, "uuid": "28b11367-e9a8-4b65-a8d0-e20bdc053b6e", "value": "T1A10723C246EB93ACC0934F706DCA539939C8319980FF8A6F35CF4C0AB555D5A88CB676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284179, "uuid": "d28c5d7c-21ae-4f07-abd3-8932280948cf", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284179, "uuid": "529ac8d9-86b4-49b8-911e-94c02ae068c2", "value": "393216:+E9VLefmwpi9JdlA0pE7FwxeJofmAJvvcVMd8khGH:+E9VLjdA0pE7TofmAlv58khGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767284179, "uuid": "5ce2f477-8d58-4d5b-8221-e737ee4db1fd", "value": 17375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767284179, "uuid": "be763f72-f91a-43a6-8328-a7ae8a78a979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767284179, "uuid": "d54ae3ca-99a3-4858-a372-992da7fbc02f", "value": "Elexum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6700696-e751-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1767299885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299885, "uuid": "63235ee1-9c88-4e08-80b4-64368fe04254", "comment": "Malware payload (SVCStealer)", "value": "91763fd6a0da2fb89df38b3ed2ee1f69", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299885, "uuid": "9a678bd7-84c8-435e-a8bb-77d7b5e7e6ea", "comment": "Malware payload (SVCStealer)", "value": "fe33c0f159c8d2f37c694215f63a95f55b498da024863b87f7f5601e0c6c42b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299885, "uuid": "9a3d710b-bc7c-4694-ac5a-5db758e11c81", "comment": "Malware payload (SVCStealer)", "value": "342376bf7b63e62ba57c69df68b1cf0e5ececa27", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767299885, "uuid": "cd3ab567-f370-427a-ba1b-fad9fdefb960", "comment": "Malware payload (SVCStealer)", "value": "7b4cf42818585e12026a7e6b472bf97a0d0168e0e530b0520220e51da1cc2c2931d5430d27d8e463ac15e8dbc1e665b1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299885, "uuid": "fb1334fa-f3e3-4960-8cf0-d19a5b37e6fe", "value": "T1CE449E22B8929132D6AA487598F5DBB58E3EBC510B6216D773C03FBF89305D0AF34B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299885, "uuid": "041835dd-d904-41d5-a234-9af2b5ca7660", "value": "0abae44faabc72ddc9922e5b949eaafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299885, "uuid": "ea82ba77-3f54-4d86-a980-83ad8070d265", "value": "6144:CZVkCIQMIQzzQ25XqH+ADmHbXJpxaEK+CS:CPkCIxIQz1qiLjkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767299885, "uuid": "14e312ea-1016-42be-ba73-ffe0abf120d8", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767299885, "uuid": "9f9256f7-6d4d-4f61-8447-4f3253401367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767299885, "uuid": "8cfc9697-e6ff-4fe0-bfaa-a6fc4eb6c8b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bf8935-e6f7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767261041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261041, "uuid": "e1c1657c-db73-4bdd-bd16-999d0fe00658", "comment": "Malware payload", "value": "d99c1d376325900762015a65b797e036", "object_relation": "md5", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261041, "uuid": "b3b0bb8e-76a1-446a-9e24-d364ccaf1086", "comment": "Malware payload", "value": "fe5200f8277eee967ce799f95689de06dd9d2d892fc52865d894e68e6fa05382", "object_relation": "sha256", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261041, "uuid": "c3f9119a-2173-4d7e-b431-7b4a133ef3c1", "comment": "Malware payload", "value": "7041c6f0fb1f0ebb8df0abf65bf74ee21a90bd17", "object_relation": "sha1", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767261041, "uuid": "3c3d5b54-b326-4aec-b353-359d208e60e5", "comment": "Malware payload", "value": "b00ca78e1f329c8f90d15782dc62c0c16a5e54ecea0eadbfcddb4bd35d09396e3db00d85ad59b52c57fd172d52a9d592", "object_relation": "sha3-384", "Tag": [ { "name": "20-195-41-174", "colour": "#56CB75", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261041, "uuid": "9d6ba4e0-9a31-401c-bd2a-8770c87fc0ff", "value": "T119B3496B73FA30F9E277827988514645E772B87157619FEF03A0425A2F232E18D39F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261041, "uuid": "c0e0457b-3a77-418d-a56e-ade4a912d833", "value": "b06601abf539feb7800c61a18ecba543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261041, "uuid": "ff43df5c-174d-4253-9c12-1f3a19193847", "value": "3072:N+HCizt1m7TfG06DHzax5XA3vC6DY+gbQJH:NbYrmsjzaPXsC49J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767261041, "uuid": "d2df7bc9-20dc-4bef-941a-3d19b09c5363", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767261041, "uuid": "bec5d396-931f-470e-a246-0ba19a09393d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767261041, "uuid": "35c68045-3c85-4f3b-adba-bc6255d8a0ea", "value": "thn1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }