{ "Event": { "published": true, "date": "2026-06-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-01", "timestamp": 1780358582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4763081c-be61-4628-a63e-7e3926e29f3f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc49882-5d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780279045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279045, "uuid": "ce555b1d-8d4a-45ac-9d78-e13077784b1d", "comment": "Malware payload (Mirai)", "value": "b31ec2a48a44b06faa9f8310423b6fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279045, "uuid": "e073a429-2b60-49e1-b30c-fab6f0e00bc2", "comment": "Malware payload (Mirai)", "value": "01eeff719a70631228f1c01fab8e2e1f7f4c9d8b03f5b2f82199f55591f44826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279045, "uuid": "455cb54d-9b54-47f8-a271-86605df76101", "comment": "Malware payload (Mirai)", "value": "934a6e1135ce4e92f1d95ee510fd5ae8f0068a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279045, "uuid": "151081f7-18ac-437d-bf19-df2f5cb4a446", "comment": "Malware payload (Mirai)", "value": "b71f0b191e024ab2208a86e957460ac120f136838ada11cc3f0052bdcd4f0f3a5858fb560a68749770235662dfb7b5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279045, "uuid": "a5636c83-dffd-4227-9b93-dc4b2f4dd735", "value": "T1D873188578969A1AC6D0537BFA1E82CD3B2573CCE3CD7207CD119F6136CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279045, "uuid": "683a1072-a7ee-4246-ae87-009b2addf877", "value": "1536:FVuza8aam2uLd70zA+3rWTKCdq5ZFPK6t:HUaZa80zbWGvP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780279045, "uuid": "c5a777b1-7b82-4d35-81b5-967cb414d73e", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780279045, "uuid": "2fc9a143-42d0-46aa-9907-7535e1f446e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279045, "uuid": "cbf7af14-f6eb-4dca-8ee6-962588a43fda", "value": "01eeff719a70631228f1c01fab8e2e1f7f4c9d8b03f5b2f82199f55591f44826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caba176a-5dd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780332541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332541, "uuid": "d1c0c2bd-497c-4eed-a7d8-1ce2c40391fb", "comment": "Malware payload", "value": "8065864cf3d8e6ffb1ecd671a9e3ef02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332541, "uuid": "a7e9040f-8913-46cc-98d2-788a94e3f78e", "comment": "Malware payload", "value": "01fedc99994c93b912248558cba5d88b9452bcc9d53d3557fd2fa41d3ac26328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332541, "uuid": "cc71374d-14a9-485d-9747-99b5bed29db2", "comment": "Malware payload", "value": "b79c2d0e6b23e4d65bca752115b98feac06a5dc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332541, "uuid": "6d9f5c0f-21f1-45d7-8702-dfc9c2053abc", "comment": "Malware payload", "value": "2af54d5fe87aa690a203805e735a628d87f3354f03913c774e035f663da42cb43d14b139e20d1f33a108e617bbc02cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332541, "uuid": "8453c47c-4608-4918-8686-6f0907d56192", "value": "T12D47DF77814338E9E5B98DB4D41025426DAC388B5738A3C7BAC471E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332541, "uuid": "7b760e74-896b-4416-9cc3-a7265b2fbd77", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780332541, "uuid": "cf5a667c-1abc-49c8-b040-57688d25acef", "value": 26378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780332541, "uuid": "8312b1ed-83fd-4701-9c69-688992fbdb71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332541, "uuid": "61fdcf05-3e60-416f-a938-12bfdb189750", "value": "20260601-055622_sftp__root__7871643142170136875_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3463d776-5d8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780298788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298788, "uuid": "2686c09c-3e04-400e-823a-3ff7f499e452", "comment": "Malware payload (Mirai)", "value": "3ea8075708dc069d6d4f6f4cf05e0515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298788, "uuid": "b2a2f9cf-bfd7-481a-b7c9-9b10c168161e", "comment": "Malware payload (Mirai)", "value": "02276c58166ac27a28daf138d94dac365a9b834dd5bacab1edad0692a0fac23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298788, "uuid": "a31036da-c346-48e2-899e-5e5da2c7941b", "comment": "Malware payload (Mirai)", "value": "1d56131ec1c976f5d4e659a951254f403ae8f441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298788, "uuid": "3406c6e9-ed81-4343-9817-463144e512d3", "comment": "Malware payload (Mirai)", "value": "d7b7381cb36d4e0e5edc3bde0e1b90448a9054c51059ce4a9fe5736c9e5e306249d8939289d39bcccf2fb2a703871af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298788, "uuid": "e9b807df-e387-4f32-9c91-472541218af3", "value": "T1D2C3E70E2E218F6DF76AC3344BF79D26939877C626D1C645D16CE5002E6438EB41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298788, "uuid": "9247211a-d650-4eaa-bace-c748832bdc54", "value": "3072:vhw5IAdRtnhtrRSLtVx+o72IKSbkNzyR95:vhw5ZdRtQxMVSom95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298788, "uuid": "4ada60be-3ce5-4f97-aa72-ff194d575a6a", "value": 120824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298788, "uuid": "eddde3a5-2363-4d19-bad7-33a41360f9a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298788, "uuid": "d04b2dca-fe94-4b3c-b30d-39ec889c11c3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3077d68-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780346755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346755, "uuid": "67fd3a71-b993-44d4-9011-20faba8438eb", "comment": "Malware payload (Mirai)", "value": "b8f92d375aff2f3e29c53b24c98e250b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346755, "uuid": "e9817540-32fd-49e2-bc90-24df006bc891", "comment": "Malware payload (Mirai)", "value": "0393a1ae2400f1e3e739c2a3072f8b4b386075f24fc4ac208c1cd222b1567056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346755, "uuid": "0691fe91-d5f7-4237-bb19-7b689f89e40b", "comment": "Malware payload (Mirai)", "value": "f06c1262e5b6bfdbfabc30926eb6ce7031529254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346755, "uuid": "e0694701-f0d7-4e70-809b-4e929c451c5b", "comment": "Malware payload (Mirai)", "value": "1d068a69f94a7f5af74557f98eca01ab787780d9960ded8bbb1094b256486610b210c5d0c04ff2a75281a40f49899226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346755, "uuid": "5c3167da-59a1-4ba7-b22b-e28bd99b616d", "value": "T118D318D7F900DEFAF81AE3364853040AB230BBA245525E772257346FED7A1D90477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346755, "uuid": "8563427d-4c30-4aa4-aeb4-8217bcd8ed38", "value": "3072:dylMMsjNyolsYppmhEdTVDjbimLg5ZtY6w4xyqTJT:uTSNyoqY+hE1Llp4xyqlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346755, "uuid": "3b5d7434-5b91-48ac-8cce-511cd6ee3070", "value": 133380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346755, "uuid": "5f8ab00b-1995-4bff-8c2c-192e549e1de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346755, "uuid": "ade5c94f-d403-4bb3-ad3e-1dc853f152b4", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0013f493-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322323, "uuid": "5e6305cf-9cda-4849-8ff0-df4a0c1e075b", "comment": "Malware payload (Mirai)", "value": "6ee83bea4a4832974f5047744ef88f34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322323, "uuid": "b31debab-1488-4f74-a161-4242e98da0af", "comment": "Malware payload (Mirai)", "value": "03b9b68eb9e85bf1b98274971ae7e1983249ab628c7d406996e948bb0ebc53be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322323, "uuid": "af955888-ac49-4be3-8bed-deb6335df96b", "comment": "Malware payload (Mirai)", "value": "eb804a55fa8aa9433d3550078880117f2548ec71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322323, "uuid": "6db007f0-c610-43ea-a393-e9570442780f", "comment": "Malware payload (Mirai)", "value": "9048e00172dd76113769326319fdfdac4bab2095c105969fdc5a026d5b0c0b63e4a1478125e29b2033f92de88fe524be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322323, "uuid": "eeb4f211-5146-461f-a586-dd52d5dfa33a", "value": "T13B03F1212215784BD1701839CAA45ECB6B6343B1F9FA223109329763BF07B9F78F5997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322323, "uuid": "fe68a3e1-87f3-40bc-baa6-fb922615f507", "value": "768:SLTUl5KJYONwcpG1Vnygy1AdZUhojmcjUmEWHR+dCnTxoHs3UozD:SP5sVygy1yZUhzQUWmCTu6zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322323, "uuid": "52526355-5315-4d40-b049-e6acd5efc11a", "value": 40140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322323, "uuid": "9e8db441-5207-45ed-9076-5526ccc32889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322323, "uuid": "788e8d2b-d49e-45cc-b4b3-adc7697d3818", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e11f50-5d8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1780299435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299435, "uuid": "40e66b19-ee2d-4d3b-bbfa-12410f447fc3", "comment": "Malware payload (Socks5Systemz)", "value": "c1cbb7aa64836bf90c2007d98236713e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299435, "uuid": "d159d92f-9e62-45a3-8b33-eb11059693dd", "comment": "Malware payload (Socks5Systemz)", "value": "0503023d8a89569f30da4456941166a7a1670e027687349f2584863674725281", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299435, "uuid": "d9c951c9-a914-453f-b1d6-a0269d4693f8", "comment": "Malware payload (Socks5Systemz)", "value": "211be411c9b719d27267677682fa6622754d53f9", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299435, "uuid": "b83debae-19e8-4b04-972c-06944d229d0b", "comment": "Malware payload (Socks5Systemz)", "value": "331a80642ce14f2b26d8961648b7fc6a35f9393dbd4bbdcd4d63f773d22494a6e28959b95ea897f93d77671168d751d9", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299435, "uuid": "31816f92-1bfd-445c-abe4-02adea384075", "value": "T127063318E0D6A7B8ED111EB3DC18802C9065377A317560BA62BED477EF527E049DCBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299435, "uuid": "5428914f-365f-4c1c-883d-1899a0bdb314", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299435, "uuid": "fabff966-6106-4e79-9ada-1b3cd22ab6e7", "value": "98304:N4ynyDUtbD2hviZtwtiYNa78ACy3tr7hO07/drAlNw:wDUg1iZ2t7Cr9x7/d8lNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299435, "uuid": "222a52a4-0f5e-49ad-b5a0-3b06d7f7daf3", "value": 3886279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299435, "uuid": "b35d709b-d3e9-4eda-b08c-435fbb82d260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299435, "uuid": "b2dc1336-71a8-4d29-8ab6-fe11837499ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60feb27b-5d9a-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780305305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305305, "uuid": "1729ec81-c7e2-4e4b-8927-fbb125584715", "comment": "Malware payload (WannaCry)", "value": "93acca98a8426e98d661be051feee325", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305305, "uuid": "2a205dde-5248-4e30-b65e-95f42ec4b471", "comment": "Malware payload (WannaCry)", "value": "05ed3739c37abb488988a1a1984e1d31f1a349a444e4e458e5d11c98fb1af73c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305305, "uuid": "728e1ca8-b3dc-475e-8f21-d69a71bc74d5", "comment": "Malware payload (WannaCry)", "value": "87d1e5b3a1e5fc3783597d36f0ea3c7b2f3c7188", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305305, "uuid": "fe9c6e86-4dcb-466b-a55e-a9b2851804cf", "comment": "Malware payload (WannaCry)", "value": "95758499221f211e928cf011ffc1f31f1246c446c360fe969c799f2917ff57b979bb75ba3434dd0d70ce9db9099ccee4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305305, "uuid": "3cf05375-12c5-4873-969c-30a54b2226e7", "value": "T1F9363394726CA1FCE0450AB444B38E1AF7B37C6967BA4B0F47C0866B0D53B97AF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305305, "uuid": "3c96bdf4-758f-4ac0-bb13-e588470869c1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305305, "uuid": "38eed3d2-db79-4be3-81e3-828085d4ac93", "value": "98304:DGDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DGDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780305305, "uuid": "c4a22092-4d62-4af7-91fc-946680163b58", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780305305, "uuid": "ca1b1ac5-4d03-414a-b715-416022f55b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305305, "uuid": "a28720c7-c94c-43e7-a639-1c3f38cda5f0", "value": "05ed3739c37abb488988a1a1984e1d31f1a349a444e4e458e5d11c98fb1af73c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27818de-5d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780283618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283618, "uuid": "fdba6fca-9f03-404a-9059-49f1cf2ad794", "comment": "Malware payload (Mirai)", "value": "78951c9675682766290ae244feb06d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283618, "uuid": "99dfb9d2-d462-4a41-bfc0-53d8418f784e", "comment": "Malware payload (Mirai)", "value": "07bcfe93ba826112d94e11ed81e99e79019187b4cef043806f98fbcb4db4aa2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283618, "uuid": "2230f417-e55b-4199-b9a8-db3ddbe24206", "comment": "Malware payload (Mirai)", "value": "a0abdfa3f2a91524cfef5db488f9f17c7376ea6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283618, "uuid": "f4b4023f-54ef-4935-b485-576565472639", "comment": "Malware payload (Mirai)", "value": "12a148d4e4518ce5d411fb28c8bd5ceb28aae563feb959ae226a2872a918a8f5e39b12b9fe440e7fba0e2c02636fcb35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283618, "uuid": "d58c4e99-13dd-4cce-bf97-047c30fcd1cd", "value": "T1CEE32A45BD929E22C6D7267BFB5E428C332723A8D3EA3203DD255F11778A82B0E77541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283618, "uuid": "f0956867-de4b-4a55-8c63-4a290c4e6e56", "value": "3072:VPEAwgy1AbkaBFF5tLdznrxFp65ypJb2vpjMywq+wH0Q+:V8LfSJLdzrxFp6opJb2vpjMjNwH0Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283618, "uuid": "ec2d8da8-3799-4fb1-a69e-2faa8232e5ad", "value": 149524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283618, "uuid": "300ccff6-f2a3-4b2c-90fb-2567ee06458d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283618, "uuid": "f6f98ae0-2e53-4c9b-9b9f-42eb4e683976", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeeb0ad-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "96bb5fd1-7446-4e4f-ad69-959a25fed889", "comment": "Malware payload (Mirai)", "value": "cf2ccd7d35d5df1429318b6e6c696697", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "a8603dc4-ab56-4c9c-8799-6ff6676fafbc", "comment": "Malware payload (Mirai)", "value": "09015d7cc063b6d89e97e2eb864c934d7bd42cce1041ad67fa3c725074565bc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "b0a5e6af-a3da-4f4f-9a3a-714419d6db28", "comment": "Malware payload (Mirai)", "value": "99c8458c21e606869b58bbe4e29b6ea60cddb53c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "278fde95-79a0-438f-bdba-1b3cbc936da7", "comment": "Malware payload (Mirai)", "value": "2f301c04ee5831b853aeacfa9711b6179485a05ee60f937f6c918c3992116ec10cbcc0ed854020345f2744f8a0a361d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "6642c0f0-40ad-4162-ba50-bb455f6ee785", "value": "T12EF2E1EAA6B5CF8BD24B06742C8F956EA81053158088DDF5BADDA07F4C58F1C1F2D389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "ee2ee266-16b9-4fda-a0fa-b086468ab088", "value": "768:ArZlPsATea76oFGEDI75JEw3vImJ4Sw7YPynbcuyD7UoQRjT:SZxDea7R0ayQjSqYPynouy8oyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292330, "uuid": "9183c699-7764-483a-afc0-1b7862ec925b", "value": 34876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292330, "uuid": "499f780e-ebae-4e49-90fd-d07b7a5e0ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "d57255ea-f585-4e4c-b342-ac8ff5e31692", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f855fc79-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780346791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346791, "uuid": "435b2fd2-34b0-411d-b6b5-0224628fa803", "comment": "Malware payload (Gafgyt)", "value": "b3c4c38b4463bb2788b645090f7f6b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346791, "uuid": "c4ff81d6-618b-4d7d-8a28-2d15ccf689f1", "comment": "Malware payload (Gafgyt)", "value": "09ee22d008be29b3264eb74128db8c10edcda9faac4f66c57e3f62222b4d0ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346791, "uuid": "649069b9-2494-434a-a2e6-baaae721202c", "comment": "Malware payload (Gafgyt)", "value": "206425e66b6679179909fbe5eef4048461077fec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346791, "uuid": "16c2b1ab-7a28-4b3b-9bb5-1a76b7b6a652", "comment": "Malware payload (Gafgyt)", "value": "66bb28ea3d95b8f2941f650f7ed53a9a303bb4de17d0f2fe0d96ba7d9456b87d03377b46ff08c8364a2b8fcb3948ff84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346791, "uuid": "30308417-a06d-4f56-9b31-44d2ba586fc4", "value": "T134632A49F9806F11D8D525BAFE4F124A73234B6CE3FD7211AE24AB2427CA96B0F77405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346791, "uuid": "0620d5ef-88bd-4558-ba78-8cf3bea9c894", "value": "1536:LVnl4BtqQg7TJr4Wr6xZAVJ7agYT66lDel1zTiPeI4WYY9x:34BtlgR6AVJ7agYT6fqeI4WYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346791, "uuid": "05ff8432-953e-4bdd-84de-dd628e15f0b3", "value": 67068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346791, "uuid": "74e7a28e-5397-4e21-9664-86b02bcfa528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346791, "uuid": "7cd0211d-007f-4c6c-a8d9-e0b477181d55", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0391cf51-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322329, "uuid": "2cc4f0ca-aca2-4dae-bb81-bfa26e81e27a", "comment": "Malware payload (Mirai)", "value": "99cff517c91f5d81e16eb0774c8a765b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322329, "uuid": "0c40dca4-c997-4606-9d42-141e3ac95054", "comment": "Malware payload (Mirai)", "value": "0a98e71f8430c7ae4b7d33161c1881bb5cb1d3c8985b6e2890482fd44bc3e08b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322329, "uuid": "fd66a506-663d-4895-965a-462d73f693e8", "comment": "Malware payload (Mirai)", "value": "6701b1940875db1b4428fa9ddaafd4b290a23f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322329, "uuid": "f7a5628f-9baf-4ed1-849f-8ba7566c0cd3", "comment": "Malware payload (Mirai)", "value": "f47500c404c58a15dcc4df96c760a7b86b2ccd4002979ab785f3e8ab576c82d6a3edb8f4e0007677ce87fe2556b8d019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322329, "uuid": "ce445cda-1c38-4de2-b65a-c29a589b288b", "value": "T1C213010041269AF1F2A06CBF5A698AE935450FFDD3B7391368F816A5B4D14DB0E6B7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322329, "uuid": "5642482f-9e98-45c8-b7e6-da3213df8252", "value": "768:JAgd+vv1WKqQK0beTbUKrH3DeAu4tbJqRFZQtxwCs7oBnkY0CjsA79q3UELUFw:JX+QLR0cbUKjDm4tbJMqwxoRkY0SsdL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322329, "uuid": "b32ea7d9-d8f4-4b1b-a42d-2f96598b21e4", "value": 43244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322329, "uuid": "0a3a19bd-6b1e-423b-8387-b526621a5038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322329, "uuid": "0ba67faa-13b4-4b9a-9533-bdf8de754a27", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e1ddba-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "f91629e4-22a3-48ff-9f8b-8088b4e521fc", "comment": "Malware payload (ConnectWise)", "value": "80c9768de0d0d1cb6922cf00e9b9a41a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "20f9c1b5-d2a8-438e-8e0a-b9892e3e4ccb", "comment": "Malware payload (ConnectWise)", "value": "0ad725278ef85a898073de341433a39adb67bf0c3ed626380c45bed0237f7983", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "622c1b38-8945-44d1-b222-e6084f9e22c7", "comment": "Malware payload (ConnectWise)", "value": "77f8b219934efe319c8bd731edbbc74c6538097a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "95b3f734-82a4-4a52-89ff-7720a9f6829a", "comment": "Malware payload (ConnectWise)", "value": "9e628b8f03e6637e158849f63c513f2596b4b890f7d13d7d38d10b1abe751376024b0dc1c2d89928e0e668d02fb43d95", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "31c9d304-1e3c-40a4-9b6f-03a0d6a0490b", "value": "T13C46E111B3D695B6D1BF0638D87A52A96774BC048316CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "09afbc7a-f841-488d-8944-56206a72609b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "62904028-2c3b-40fb-88d4-87acc8fad0bd", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300032, "uuid": "85fbad02-02b6-4982-96d0-f3e89908b6a2", "value": 5693472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300032, "uuid": "ff92abd5-ad63-4c27-9a2b-6395854af237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "bbc68059-990c-479e-9884-ac11e9545382", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46545309-5d9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780307408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307408, "uuid": "7c5b8d9c-2092-4a99-a242-59cffa6786a4", "comment": "Malware payload", "value": "e6cc65de4985d30efe198f7a8127c087", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307408, "uuid": "43beea65-c562-4d90-bf9e-10ea5117e5e2", "comment": "Malware payload", "value": "0b4c4b4591b88e68ad54cb762db5ad5c06b43f8df0c6b2f9967c861f66c0c18e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307408, "uuid": "5e66d4e2-9642-44a3-992f-ea9d13a7056b", "comment": "Malware payload", "value": "1788f944f5f888169c762d870d30746427fd64df", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307408, "uuid": "c2208de8-b69b-4f69-8c5a-ec0c1da5900f", "comment": "Malware payload", "value": "4d9b4975126de6d460f6c82985cfd7076c1cbd1382fcba681d4437db10bf77546b2aef14bde20c058c0991116d2fe68a", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307408, "uuid": "afaa301b-5825-423a-a6c5-e036dee65de2", "value": "T1513633BCF3E975DDC1647039C154BE662ED23A6DE3A1331FA28C65A91E4E6D0C0390DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307408, "uuid": "edf0d0e3-5ad1-4228-a2f4-9bd8c50d52cd", "value": "98304:jKF7IDqg+1peBV9EhWHbDNvL7fIcG3DBeEeE9KncxD:aIWXkBjHb6/teE1Gc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780307408, "uuid": "a455a937-14da-4ab7-b8c9-5f25f2056f47", "value": 4868096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780307408, "uuid": "614d236f-2259-4996-8903-db004842913e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307408, "uuid": "77b7241f-beee-4853-934d-3e5e4565704d", "value": "tax details.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7129d2ce-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780312204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312204, "uuid": "f997e441-0a6a-4af3-9b27-2ffd7248e9cf", "comment": "Malware payload", "value": "ee1f7215882331c5bbd2271a4ef13ca8", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312204, "uuid": "6035982a-24ef-47a7-b6f9-caf57643a35e", "comment": "Malware payload", "value": "0bc2db1208dc232ad1ad539b64c6d176ffe6f41730dfa96c6f471273d369fdbe", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312204, "uuid": "d2773e26-1772-49ba-b495-5e714380b2b1", "comment": "Malware payload", "value": "a9fdedef3d1ee7454e30e138bab60c886cb999cc", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312204, "uuid": "a044fac0-abd8-4391-b1b9-46c32a2c5999", "comment": "Malware payload", "value": "48d9a2171e2d8fe076d0547869fa347e15e0793a8851e008cbed7c90c4414c3f5d884ee1c780da94b06151a355f098cb", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312204, "uuid": "cc2c5ba6-f850-44a1-88a0-18c6d17b7770", "value": "T1D984237169677512F84E81B991418844BABFC239CBC075C7B868CF6236FE824CAD57F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312204, "uuid": "24a2e17a-4c69-4fe5-ae36-a924acfade2d", "value": "6144:4qOOQ9fDkWzSUa/XHC41LQkcThSMy5KCzeST07nV8mtTfwf3If:+9Na/XHC41LQkASMcV+V8mtT4f3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312204, "uuid": "05d09d9f-c289-416f-9967-fe11613be52f", "value": 373993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312204, "uuid": "231a7ffb-a7ab-4116-ad31-dbdd16511f6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312204, "uuid": "9fbca345-de67-4548-9fde-1e9883ee5c02", "value": "20260601-001173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775ae037-5d8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780299330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299330, "uuid": "f258ea90-22a6-4449-b7cf-c434aea47353", "comment": "Malware payload (Mirai)", "value": "77b7aea8d0e16a8277e8dfdffd8c0914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299330, "uuid": "34353428-a4c2-47fe-b4d6-004cf6a4826e", "comment": "Malware payload (Mirai)", "value": "0cf5619b0577873f43e7960c30e7e73aacd49ba26089e57e44520b7fb4e09c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299330, "uuid": "3a66d749-5a49-41a7-bf49-fa8cfa3564dc", "comment": "Malware payload (Mirai)", "value": "1d23ab0486869737258c6ef4636648efe4e404c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299330, "uuid": "ca4edcd4-8f41-466e-8240-5d6713eee4f2", "comment": "Malware payload (Mirai)", "value": "2570788351e267f2f6d4cc556afc6f0600afb53bb2bf6619b593a673f1b9b636c2c6ee93eb3b5752bdfe4b1eee2c42ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299330, "uuid": "9ac0d444-ac03-4b18-98d9-d9566cc752ed", "value": "T18F932895BC928A16C6C513BBFA1E42CD372663DCE2DE3103CD259F2133CA96B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299330, "uuid": "bbc894f8-2343-4014-8728-dc6a1c6c057a", "value": "1536:JIIR/v4/2hpA9ZSHtZEK082PHIMVUByXBCHkdkrGgvM2:iIZ48pFNZEKovD7CH1HM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299330, "uuid": "9710afc8-13c3-4082-98c4-b31143a9ff88", "value": 92408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299330, "uuid": "c577197b-9b40-4af2-b72f-255bf6485d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299330, "uuid": "a11e3379-9696-4d3b-b710-011369b96772", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e470ecd4-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780346758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346758, "uuid": "e5ef63f9-35e9-4569-9c41-844b0f3d5f2d", "comment": "Malware payload (Mirai)", "value": "8affdbdac15bf51d12e3f493c5d015b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346758, "uuid": "08455593-d440-4d21-b70b-3cf51d3d785f", "comment": "Malware payload (Mirai)", "value": "0e9a4eb615706f7d7099d954e2c09d33cbcde4952177c5910456f4ec1a101975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346758, "uuid": "d9c18e44-4522-4371-bbc3-33c7f32a04fb", "comment": "Malware payload (Mirai)", "value": "d4e0216fd0660b469b9be5554dc34c81a1b991aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346758, "uuid": "48c5ac5b-9ef5-420f-8bc0-e6913808f409", "comment": "Malware payload (Mirai)", "value": "5863507037a026e9c8e005d24af43f00af6d0abcdcbebbb0283df1cd4f9dfaac6f476d54d41dacc33d7a65ac19bb7dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346758, "uuid": "01691a1a-09d8-4025-8073-6d95dc090a6b", "value": "T11023F1FEB5048EC2D278817C077227A02A514F699093CD11BFD5AB638D1A9A93E43BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346758, "uuid": "1cc069c8-efb5-48cf-8b17-7aa56245ad02", "value": "768:/X91tdV/f7VQzKMljYg46tn0GM+78tCvmVICFXNICdIopxJgGlzDpbuR1Jt:fhDH7VQzK+Eg4Gjb1ChNNdIoBVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346758, "uuid": "823f8daa-9b1f-4650-948b-ab78badd49d5", "value": 47540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346758, "uuid": "ac2f526a-8162-439e-b77d-1894405bdefe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346758, "uuid": "4590d2bd-47fe-42c2-ada4-3e1df4ed1c2c", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfff409e-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "0c178e7b-6116-445d-bdbf-b48270d4bd2b", "comment": "Malware payload (Mirai)", "value": "61a89f77c8d3fbbde7ee21d8ef0273bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "53f51423-3e4d-457a-ba16-876b48e64f11", "comment": "Malware payload (Mirai)", "value": "0efe369d20d31c2e94dd6afe1e69966df5cb38f9ea1eaf56c9199c3ad284e76b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "d7d47e29-b18d-4f30-bfd3-8235f03345d0", "comment": "Malware payload (Mirai)", "value": "0868ef09947dc62ad35cabae08680cd639211e74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "de580d8e-845c-4f9e-b81f-17f63f5e4d95", "comment": "Malware payload (Mirai)", "value": "ec93a2adc86b2c612de21a628e689902ff8986367fad4ee5760e49a45cfeb6ae6cbedd298c3d5971c9f68259416ba0b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "1313d7e9-e0ce-4489-a9c1-360b48863fda", "value": "T1E1B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "a8bf01d1-6e8e-40ad-8164-b69623eb4ac6", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJk:4azwz102cPPaRl+AS97Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292177, "uuid": "c64f8f23-b6da-4ba3-b4cb-83415100a1a0", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292177, "uuid": "82c712e1-1427-4c04-bd36-19f65cc176d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "956cd14f-4bdb-46ba-9d77-9c0ddbbe75ce", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63f8086-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "66494672-b3ef-493e-b7dc-f77dd65b7f69", "comment": "Malware payload (Mirai)", "value": "c4ab9821e594f7fef31f7aa7fb812582", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "3d3a9e7b-a476-403b-bd52-bb87d9f31818", "comment": "Malware payload (Mirai)", "value": "10947b6c23490f8f76fea478a4a8b7df2cbd7e7c291e48eb88a66b681c5cdb90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "49f9f891-98ae-44cd-8b5c-c10bac3b325b", "comment": "Malware payload (Mirai)", "value": "f8c16bf003f5e50ee1ca0626a62e56d85897902b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "efe3af46-f745-414c-bc2e-42b53113c6ca", "comment": "Malware payload (Mirai)", "value": "689a6892d52793cde4bc6b4c140108ff1a57f28b17f9525190d7c8c24453ba5b81de3066f0ba8bac7428800254a198c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "434ecfea-6b88-4b6d-afff-879668bcd945", "value": "T13E83ADBBE42A5E60D24589B078B5CF311F63A5C082532FBA26E587786087D9CF905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "d003d0fc-df47-41ad-b391-b91382a0d787", "value": "1536:cawoNhLhkfaHuoRMc3wdiUqdwKsm7h7l0bxxCOU5B236kS:cCp6faOAh3wd3qdXs4ebxxO54KkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312401, "uuid": "eac04aa3-a6b4-43a5-8dda-fed10dfa2f69", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312401, "uuid": "0caa80bd-4f6e-4332-b0b6-5dac0fae9d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "7f5a6d60-69d1-4a29-9274-29580a3fd1bb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d26ea2-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780346752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346752, "uuid": "5566ccef-ae4f-4312-baee-569db62669a6", "comment": "Malware payload (Mirai)", "value": "c1c9a8ab0a2b15a6249a6b65ce14a1c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346752, "uuid": "ca05fc24-f38d-4008-a083-697a9db2d507", "comment": "Malware payload (Mirai)", "value": "1184d9465a8167b6dd2b52122f69fd93113c9d0aa3cd873551117eb4f705bc0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346752, "uuid": "cecdf8eb-979a-40ea-85cb-9c73991a6792", "comment": "Malware payload (Mirai)", "value": "66b3ef2b753dfd27b49e6c2eb3d428fd80bd53d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346752, "uuid": "58ab38c6-fdfe-41b6-a031-fc671d78d41e", "comment": "Malware payload (Mirai)", "value": "343506995400fa9b589c53f4ca19577b43aa8d334d40e3609a7dd988ccbaf44b52f38297a4970df069afe08543b25adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346752, "uuid": "5d5c0c91-62f6-4e5e-a084-6c55b0dc6f11", "value": "T12F23F1DC21534AD5D0A494B987C507A27EB31230B9C7EA867B8CC552EDDA7C1A4829EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346752, "uuid": "24703137-f7a1-4ac4-856e-94e1ebae7124", "value": "768:CBhmgh5Wa8a10RuTuyRc2L3eJFFqr/61FwdhwRzSHHx57xlPzMxAJgGlzDpbuR1g:sbhIa1cuTuyuwu8rOFw3wR2nx57zP2AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346752, "uuid": "aedf451e-191c-4774-9fc0-527fe3b520e3", "value": 47564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346752, "uuid": "e677bf9f-9db6-424e-a2f4-d72d77039b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346752, "uuid": "8eacaa7f-658c-4db1-94d4-03f59dcc87da", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b89552-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322381, "uuid": "99352338-3e49-430a-ac0c-56734dd4f9e0", "comment": "Malware payload (Mirai)", "value": "f2fc04e8f974d8487ce38970450d3da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322381, "uuid": "31525bc9-9095-4c77-a45b-dc9d07b2f544", "comment": "Malware payload (Mirai)", "value": "13d4d6780e4e1ee8845e45feca218aada19ab1ff00ebdbdcd166c6aed8c4ea5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322381, "uuid": "5dc48c9e-fc33-418a-921d-edd200038590", "comment": "Malware payload (Mirai)", "value": "301bdb795a0f73f976daf7cfeaf3d5d86ed642d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322381, "uuid": "a5af7f0a-0ce4-4f9f-abc4-783a38dc04f6", "comment": "Malware payload (Mirai)", "value": "86119b5974b358aa74b00efc7c2068a96dc3855f57b746aed0351e22e9dc0efb74b322d25f161dc875e07e20a20f79d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322381, "uuid": "cc41fcd3-409e-4b3d-bf70-5072efb5cb99", "value": "T149835C01B38C0D43D1671EB13A3F27E697AFD9C123F0FA89265F9A469171933154AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322381, "uuid": "767f270d-6ffa-4e38-8ddf-991d5c3b2099", "value": "1536:68qU7GZ5cEHK0osuBtpWyzsDdSR/bQyP+ImUbpPoncp:dqU72cH06jHR/bTPtkcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322381, "uuid": "92f63504-edf9-4204-835c-17280bc5e79e", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322381, "uuid": "a943c6e2-c7d8-46f0-ab81-61f2858ffcf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322381, "uuid": "7b92c25f-0e57-4822-8683-d06d9c91d00d", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2124069-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780293523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293523, "uuid": "c91fe259-c310-4943-91f2-1ad4b80f2b63", "comment": "Malware payload", "value": "99ae7d2ac0c45b996d141ba9f7f1bef6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293523, "uuid": "9f2f6038-0010-4f60-a3b3-1ef5b5d35c19", "comment": "Malware payload", "value": "145f3d9ad7ab0e6a4df5b951f2ced9052d91172636e1206d4d5c0127d1995aaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293523, "uuid": "208481eb-474c-4798-a9a7-b19467ea2161", "comment": "Malware payload", "value": "2ab1c752e578bb7c13f4701653b20fbbf9e20061", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293523, "uuid": "d3037f73-e653-4990-9550-b2a5c1b7e427", "comment": "Malware payload", "value": "25bfbd7f346658d44f9be6abba135269b8cc2b41717cbd57b1279202e98e301c4b4a4120068e73850dcdd5a0c931959a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293523, "uuid": "a7a76d02-1947-4d2e-aabb-dae90c9a6748", "value": "T1AC763B97B8924952C4E43A37BCBE81C432630EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293523, "uuid": "24b72154-e44b-4b60-b95b-44dfdcbb5cd2", "value": "49152:AP6IZgzgqtv4iFKUwlsVGNvqf4Tmm5G4SSU+5cO78gyq35EkY:7IAgIPcUwlsVGNvqScO78zqpE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293523, "uuid": "1efb7173-7286-452c-93f3-94b3cd2759bf", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293523, "uuid": "69e164f5-a354-496a-a470-964c06cd7ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293523, "uuid": "fe87aff9-0542-4722-b98f-43aa95656ec8", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171c41d1-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780316778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316778, "uuid": "8890a6b4-585b-4bc8-9e65-1ad064ecec84", "comment": "Malware payload (AgentTesla)", "value": "278d20592916def1779b344f9ddb4a39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316778, "uuid": "1a98b57b-31c1-4fdc-9ef8-9dee27053501", "comment": "Malware payload (AgentTesla)", "value": "14dcafc022ffdebaddd85d8880e262c1869673e5a3cad1f02bede043c86deba4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316778, "uuid": "a02a3a26-8981-4302-b5a4-fac5da407d3b", "comment": "Malware payload (AgentTesla)", "value": "96a2012eb5b9c03e937cebeb302e8cb699e7ef9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316778, "uuid": "e1441542-df96-4970-a8e5-e8dfa6677387", "comment": "Malware payload (AgentTesla)", "value": "f3df065975ba7360d3c4b6853cd4865cf58463b544b913f4c91d4bd487bca6405345ce640f049198cc641a8b54f7e915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316778, "uuid": "abae3a30-b18a-4e10-9579-3775d6d8432a", "value": "T1584687059755A036BB0ADBBF623B9450BE0E96B23489CF3F344AD6117E10D1BA3E52F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316778, "uuid": "b2e84275-6471-403a-8e9e-91030ecd3744", "value": "98304:1XlGIuBoZrOQcRuhe+TMjjYvQfNDX8HqCl7pEMWQrAA3PnAwBpPDj0mf1u29tfrZ:uoZiQcRu0+YPY458Hjl9hM4rDPDB1u21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316778, "uuid": "7e09a865-a795-4794-9bff-da4e6aa0dfba", "value": 5838889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316778, "uuid": "b65ec233-27cd-4e2b-967d-81c660052877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316778, "uuid": "91d90668-24bc-49e6-a619-8b3e6f6c8824", "value": "swift copy.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336f0dcf-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274305, "uuid": "6ef53fb4-6bca-4b2c-aa62-ade6211921f1", "comment": "Malware payload (Mirai)", "value": "195cffecaecbcef4fa4fb4662020ce98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274305, "uuid": "049f5207-e147-409f-a70e-813258687827", "comment": "Malware payload (Mirai)", "value": "15f92cf177805802b9a26511e5311c9022e53fdfd5069469ec65c2aaf4adcfdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274305, "uuid": "ca8a40b4-6d9b-48c7-8d3b-e5479e2d609f", "comment": "Malware payload (Mirai)", "value": "91f4f912c3acf2b8beed297a4bfb0a827d6137c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274305, "uuid": "2941de5d-c3bb-4e70-81fe-aea852bb2581", "comment": "Malware payload (Mirai)", "value": "95a3e8ca97dc48fa30d2733d85ee03166c683ad8b114e70e3d390ae6ef2b99a43ccd1711208ccb235fcec6252348540a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274305, "uuid": "ea218373-f1ad-4b80-b75e-5f5989a887e1", "value": "T12D93D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274305, "uuid": "f3a0393a-e476-447d-93dd-62e7730cc8bf", "value": "1536:lX1tMe0R/thi6fZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//hEp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274305, "uuid": "d50e15f6-56ca-4b34-8d98-c01d0d09af33", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274305, "uuid": "ddaf42ca-eb82-4467-a082-38c3b6037cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274305, "uuid": "28df6078-1d8a-42e9-9c03-b3cfe0ed2bf3", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3231b8b8-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274303, "uuid": "08fddfd2-4ad0-4b3d-be90-a539bf495ac6", "comment": "Malware payload (Mirai)", "value": "8911db589783fd0a7b7669c862423a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274303, "uuid": "cc629e85-ee1a-419e-9732-5e0493513325", "comment": "Malware payload (Mirai)", "value": "170a6103bac491fbd670203d1dcca8bc355f8e80b742277fa59b287a4297eebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274303, "uuid": "a977beee-741f-4811-8855-e2c759b41809", "comment": "Malware payload (Mirai)", "value": "2a62769b4cd9d0d41596713adb6a81245083ae4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274303, "uuid": "79c680b9-e919-4cc9-8c52-7f4872f6e394", "comment": "Malware payload (Mirai)", "value": "1d19c56601ea0bcbffed7d34a6d32b77c804c6965d63661c59fc35fe98434c1a5f02f942d81233e19264500d3e5e8b7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274303, "uuid": "869cd6bc-d251-4621-94db-65db32aeda11", "value": "T141730995B8818B22C9D512BAFE1E118E3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274303, "uuid": "82e9aa2e-bf04-4590-82bf-fa69bacbe37c", "value": "1536:TAnIeDGCSP2GevKo+tYaX9uDjQkMOi4dC/10k7Yv5GYMd:iKC95z+tYaXadC/10k0vMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274303, "uuid": "ca6892cb-076e-4e80-a47e-582acbf84fe8", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274303, "uuid": "ede4b825-97d8-4e56-be15-6f7494996c32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274303, "uuid": "3d6af914-2ba4-49ef-82ec-e4977d2a0c54", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fe5f0b-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780294127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294127, "uuid": "8d6a1823-7df3-4631-a747-a3d70770730a", "comment": "Malware payload (AgentTesla)", "value": "9d750f0df3a8d159a089b441ac3fd412", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294127, "uuid": "70a80072-7e44-477d-84d8-1916e75df0b2", "comment": "Malware payload (AgentTesla)", "value": "17809d68a3d7bb0b12de7f610a0adb3346b57c036c6295918ece95d6b6b3a340", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294127, "uuid": "05beef1b-1fd6-4590-bf6b-e7d554579e16", "comment": "Malware payload (AgentTesla)", "value": "676b0dfeea6a87144b35eeeb1d8d14bad0a19ab2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294127, "uuid": "e96ca3f3-c9cb-41bf-9d0b-23606fedc8ce", "comment": "Malware payload (AgentTesla)", "value": "416ab7684a9837db8963caf7aae625f39691156d6bc78c2c9fa92589a52375e3d9e2f3409f710cf6e81c66a2a845ccfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294127, "uuid": "7d8b2330-3b58-4933-9c63-a64bf121b5ba", "value": "T1B646A70593D95036B7BB97AEEE376941A80DD3B1288ACF3E30084520BD51D9B63D66F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294127, "uuid": "561abae9-8ee6-45b8-a129-270bc16d37bb", "value": "98304:NAH9RD9i7XCV0baHD/JYL/3TZPvYFv3c3/9DVie+sICQcTKZVo87u78vQl:N+ib0wW6jZvYFv3c3FDVFICQQ4B5vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780294127, "uuid": "ace9342b-2d7e-42e2-a274-d4b3e5343e6f", "value": 5840705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780294127, "uuid": "0b6a60bf-397f-4fcb-befb-d10b1b547bff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294127, "uuid": "df291603-cfdb-4994-8725-db7c8ff38087", "value": "COMPROBANTE DE TRANSFERENCIA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f1778f-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780299995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299995, "uuid": "49c0a829-9001-4e34-b362-44b3086f9e6d", "comment": "Malware payload (ConnectWise)", "value": "ce48d1f6143f4111c673d3a5f1f089c4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299995, "uuid": "c2dda42f-6fbb-45db-b788-90c7df0449b3", "comment": "Malware payload (ConnectWise)", "value": "1796befcefffa17ef1a78f79dade0a9f4288c626b2c337c956d15fb09410bfe1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299995, "uuid": "226cfd63-b06c-405b-90b5-f1de5bb45560", "comment": "Malware payload (ConnectWise)", "value": "3b6b9037a5050514abca47228fca9a594d80aafa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299995, "uuid": "bfd5d475-7b1f-4e67-a499-bc58d11a7960", "comment": "Malware payload (ConnectWise)", "value": "2612c3ccdf2729a7eed133667553ff8de04444fd88ad6d6d366916d6ce1d92baf96b0babcc1ee928bc19699caa96bc2f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299995, "uuid": "45a735fa-82b7-4d12-9796-777df3659121", "value": "T1D546E111B3D695B6D1BF0638D87A52696774BC048316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299995, "uuid": "ce7b3a70-2783-4610-abba-f06c2f39063b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299995, "uuid": "70b1558a-a617-4577-8cfb-442f5484fa79", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ahfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299995, "uuid": "f92753b2-81ed-4e76-ae3c-2f1dac805cab", "value": 5676448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299995, "uuid": "dadd8bb7-f628-47b8-99d0-5c21898f6f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299995, "uuid": "b2590a4e-27b4-4d6f-89ba-ba6af653fb8b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccde5fc-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780292897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "3bcd0033-6f03-48f7-8dff-21c27af665db", "comment": "Malware payload", "value": "fa9e3dba5666e1886a111d8b55ce0ad0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "fe3997ab-ac17-42c0-ae34-1ff309272182", "comment": "Malware payload", "value": "17bedb1339ebbaf1d7a14b3d886c7f135bb979a26de49e0a07de2c5e8af49a72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "3f2822e7-dcfa-453a-a983-6ccd5890d24e", "comment": "Malware payload", "value": "03373ae348db329db91a343937acd31c37ce0e5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "5947eda8-7c44-4841-a23e-0b7ddb4bf8df", "comment": "Malware payload", "value": "be15ce2f978ab4ce6bfb6868965fc906b55c47e8bed3cdcd66429eeffd149867d0472cc1cbf6201911739c289d4296eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "67b8db65-07dd-407a-8013-888981911472", "value": "T1A463F892FA41D941C5D938BAFA2F41C833830B6CC3EE71069E01AF35B5EF9594E7A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "c9201aea-c805-40d8-9ab5-ed6e4a9c5ab1", "value": "1536:D1rN8Blf3Y/yB2UbfCm0VOawF+rDPizTHOa/T+7:F09IUbP5an/izT9q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292897, "uuid": "b5c01094-4090-49ac-b8e4-4ac6f5e7e3ba", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292897, "uuid": "5af945ad-2acd-4eb3-b3b7-987d2d3f502c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "9aa8a2a6-dc3c-4865-842a-e5e7dd65f9af", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80df122a-5daf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1780314378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314378, "uuid": "2203b987-f183-4637-9a94-76a3ec0a904c", "comment": "Malware payload (Gh0stRAT)", "value": "b4e2a4ca86f24cf39e2f43dccdf321b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314378, "uuid": "261fe527-8219-47fd-8e63-22cb6ebe1c47", "comment": "Malware payload (Gh0stRAT)", "value": "17fc02be307af162f241917f3a0f23c89fc83d3334000b4e5fb88c6cdad3e956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314378, "uuid": "2ad4a945-fa8f-44e5-a7d7-5445fa400099", "comment": "Malware payload (Gh0stRAT)", "value": "be42becd8d03ece041aa2e3ca1991e6477cd12cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314378, "uuid": "110af7a1-ac13-4365-bc5e-1facd21db60a", "comment": "Malware payload (Gh0stRAT)", "value": "d6d3d14482ce63d58425b64f2cb6947f0ea9b25d477c0d98837191e9420e22969eeaedf471c470f1e8671ddec1e608e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314378, "uuid": "101630b8-0e2b-4810-aa74-390f9220b8eb", "value": "T19718331762C7A63FF2799A71593BF298593B3A6298134CE78AE414ACCF251C41D3F207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314378, "uuid": "5c6d4040-7918-4b68-bfce-a2c2d658e3e4", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314378, "uuid": "52683630-0288-4262-8083-69e1c6d7a6be", "value": "1572864:4WjwR81zr/b1Vx6br08+B2CcIpaLA25pFKRKRV2NoWNgQNLXLgRToGjM3:U81/T1008LCcUa0g/yeQNLLgRToGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780314378, "uuid": "df900d4c-4a5f-4779-82c2-fc4f17691feb", "value": 90544033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780314378, "uuid": "fd1a383e-91e6-4010-b320-227481fa6781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314378, "uuid": "ca8cf4f2-bd3f-426d-932f-2d406f322ed1", "value": "Hfox_win_x64.15.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f7d9a3-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "82ef1e73-bf78-40ed-b56e-67302c6dc891", "comment": "Malware payload (Mirai)", "value": "84de8b233834cea2f9222efaa6af55a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "88286f86-7080-4237-88b9-e646530b5208", "comment": "Malware payload (Mirai)", "value": "181351b0d763b76b28780f63d1ba414dc02e14d4d8849d4fcbc06549bc03b4a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "d86fb35d-2007-4176-8f0d-e8c619251bb5", "comment": "Malware payload (Mirai)", "value": "e82a83710f7f5c242a2776b79a34a2079f4b78a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "03c04154-8ac3-4201-9997-a869ebf44956", "comment": "Malware payload (Mirai)", "value": "70556eebb0436d5c4646fa365a0ed1b9b36780bc8ef63feae4f49f0777f3bdd3da7121cfc90dbbb970185c387d36a4af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "7290bb20-3fbd-4eb0-b64a-ed6920fa2da4", "value": "T1BEB33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "0b32ea23-40c7-4d26-94ff-9f21c16988d2", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJ7:4azwz102cPPaRl+AS97J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293719, "uuid": "b2ee6d97-511b-4422-bc03-fa48a04e215e", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293719, "uuid": "e935e4ef-a92f-4489-944f-1923d1df7448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "a3e2bfb0-2713-464d-9c43-447cdc53bdf4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f0485-5d76-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780289950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289950, "uuid": "f7d8d9b3-b79a-41ad-a569-582f466855ca", "comment": "Malware payload (Prometei)", "value": "08d6dc6301fdcee5bd284b3145e1fec2", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289950, "uuid": "2fe93748-8246-4d9e-a730-eb8db2e71b63", "comment": "Malware payload (Prometei)", "value": "185af45f10ba68b97d7a6e3ccebd55bf7cb457f905a00eb39485a054d128182c", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289950, "uuid": "6d6c2d28-88da-4c21-821a-48fca795f26e", "comment": "Malware payload (Prometei)", "value": "24c724a1b975d1963982a156af51b0855bf753c5", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289950, "uuid": "69fd48a2-22d8-4968-8a3b-fe6773332691", "comment": "Malware payload (Prometei)", "value": "0d42e28ca61764591fe00c5b64f1673a8c3bf80c096e585825c76b792d1c654310e0d22b25631d5493241e314168a11e", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289950, "uuid": "37d1901f-0284-44e9-bedd-9f36946e41d3", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289950, "uuid": "1e812aa3-9479-485b-90f1-6b20aedfa4bb", "value": "3:B5oIMln:fml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780289950, "uuid": "8f0c21ce-0f99-43ce-9143-783af83bd735", "value": 13, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780289950, "uuid": "bced4305-d696-4b84-87b3-35e768ee155a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289950, "uuid": "b1c8cad3-6260-430c-af1a-15755d214716", "value": "185af45f10ba68b97d7a6e3ccebd55bf7cb457f905a00eb39485a054d128182c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cb598e-5def-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780341760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341760, "uuid": "df95a014-8e60-40c7-94d5-7496a8f49525", "comment": "Malware payload (Mirai)", "value": "d5f45556917acc6929a917d7ff36fbbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341760, "uuid": "3bf7b15e-5e75-440c-9555-dc65dda542d9", "comment": "Malware payload (Mirai)", "value": "1975ee91be01a7516ce368735756f3e1508b1e77f5e7cec94e472643d8d43ea8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341760, "uuid": "5a0e2dda-7bb6-4078-b990-f0e4bde1a54c", "comment": "Malware payload (Mirai)", "value": "fa390ed286b98b18e3e34132f1ddac01c7cadc40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341760, "uuid": "106beddf-41b1-4c26-a0ea-72763c1260f1", "comment": "Malware payload (Mirai)", "value": "67975ac388ebd3d0af8b270fcaa437c6f4213feb8f496676973baeff408a205232c4343fc0cf179f8f55ead112173283", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341760, "uuid": "62639387-d287-4173-971b-9f338d86128d", "value": "T1D4935BD6F801DD7DF84FD77A4457090ABA30D3A21B830A277767FDA7AC760A4481AE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341760, "uuid": "cbab42fe-3f3a-4515-aecf-f8ee506d7db2", "value": "1536:Bdl4YS6sa+IIl+Mlol7c8OEtYrQoFu7at92uQw9CiJxXu3mb:WBvlol7rS7FSarMiJx+3mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780341760, "uuid": "c02a5315-7b31-4848-be8f-9a1962547343", "value": 92540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780341760, "uuid": "d44b5a87-f2eb-4534-9431-581f97885b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341760, "uuid": "71bff876-4f26-48bd-9093-a49eb5245399", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ac248d-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274259, "uuid": "ce40de44-21a7-4a37-8631-9ee890504801", "comment": "Malware payload (Mirai)", "value": "58913f1f27f1d7706f01e5e65969ac5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274259, "uuid": "67ec4c85-9016-480a-b21e-599caaf2c479", "comment": "Malware payload (Mirai)", "value": "1a14d820ac51fa77f0b9ad0bb0319d099e0251415bef559e8e324e2a9b68e4e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274259, "uuid": "5f2d6f69-b6c8-4e4a-ae65-4522eb0e67b4", "comment": "Malware payload (Mirai)", "value": "0a08c2d54ba59c77fadb712df312ed4d46dd2f37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274259, "uuid": "fda50c8c-cc8c-4228-8f84-e43940c48fd8", "comment": "Malware payload (Mirai)", "value": "6c78aced38dd3e08ee22d3f9fe1e01475ed7ee29ac1c05e74cfbd5375e2ba4cbac31813dff43aabd1551d0bc242f3c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274259, "uuid": "7a7d0867-912f-44d2-bfeb-55954cd46d3c", "value": "T185F2F241B119AA13C970A5B7981604F12FB0AF79C0BF759F113C7ADAB6C76061B73983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274259, "uuid": "3548fe4f-e9d7-490d-bfb6-f561fdb977f8", "value": "768:ss8gOvvs+q8Ki/zshZQm5aXbOT+RtEVOnfSPCA9q3UEL6x:ss8gOvvTE+uZQmMrai4ySqLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274259, "uuid": "0406e85d-926a-4696-bebe-33d1fae8c937", "value": 37256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274259, "uuid": "07e8b8bc-073b-4dbd-94a8-12894433c74f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274259, "uuid": "a9490bec-5f98-4ab4-80f6-06e48481a631", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676d98e3-5dce-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1780327650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327650, "uuid": "97bb485a-e99d-4134-9532-f351e68cd257", "comment": "Malware payload (BlankGrabber)", "value": "9acd3756f74aca3a39f29bc7c133c216", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327650, "uuid": "4d5c4472-30ab-4fb4-a2a7-b96ca758215f", "comment": "Malware payload (BlankGrabber)", "value": "1a40a2016ba80e5cd702e8288a56cae1b8baf5da40d91478690f2a2096d1feb6", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327650, "uuid": "9b9f850b-60d4-4782-b5a3-5d9ef2609b77", "comment": "Malware payload (BlankGrabber)", "value": "2d38ee850fc677b89b65d7a8d6e1961ae3f9d3f0", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327650, "uuid": "3bbccbf3-d3c1-4b31-9d30-adb67554a4f8", "comment": "Malware payload (BlankGrabber)", "value": "f847a5442026b679be8fdbc65086fb1d70cb9f45753119da42fc124a81bcf959f0fc4f46f1bfab0d7e5532ce18a6054c", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327650, "uuid": "0464902e-3547-414a-8457-12c24deb9244", "value": "T1D4763398A77501EAF5FBE23CC902C556BB31B5298365DAE703D082292F236D16D7FB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327650, "uuid": "b70df044-c2da-4fef-912f-cdbedbb5939a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327650, "uuid": "c4c50701-1b29-451c-ae39-5a21a20c0dee", "value": "196608:HV1ACN5B6ylnlPzf+JiJCsmFMvYn625RXyqR:kgBRlnlPSa7mmvYZdyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780327650, "uuid": "e9e4fb8c-e6b8-4592-904d-b9825d6a211d", "value": 7194387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780327650, "uuid": "a2c0d0c9-19bd-4aca-9f27-bb1dd7f4bc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327650, "uuid": "30936ddc-c645-4939-bb68-cec37e9489c1", "value": "Built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01fc2c3-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "b2c97389-782e-4f2a-abcb-ec6b1a0c598b", "comment": "Malware payload (Mirai)", "value": "8fe13c2a8387d8e9fd528134367377cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "e07192a8-78fb-4a07-8bbc-2be84fdb1b24", "comment": "Malware payload (Mirai)", "value": "1bc18899afaca84f0cbbe01e4d5724d202f19f76208548e4c5bc64d8e665aacf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "b32394a8-df4c-4cbb-85eb-acb3f248308c", "comment": "Malware payload (Mirai)", "value": "98677a86b7b62d46c9d3b331c9f2e292756d94ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "01be6885-1999-49e7-b6a6-9a16e7159ff2", "comment": "Malware payload (Mirai)", "value": "f459395e1bcec1b6f6d82e8c53681a4c543b47b42418a92a7d5956e75cd79f98ad10370c6b01053b461fea7bd9c7c214", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "aa85be9c-5eb6-4d40-bdeb-08d2f6603d69", "value": "T1EF262957B8928683C4E4367AA8BDC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "a1d1fc5d-53f9-43a0-8487-b878ec250512", "value": "49152:zk/x9iMG54PamkCK65OUV4Frhw1ofFrI5lQU1F1:w/xUMGKXkCK6PGrI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323558, "uuid": "87b03ddf-0c33-4553-8c92-42b35a63d4e6", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323558, "uuid": "80cd59c9-98d5-4b46-9e1a-18305f2509c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "178eccf2-438d-462c-b027-53187c8599f9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5524d2f-5d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780283623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283623, "uuid": "1861bf91-39d1-4095-83e1-1bfe12631478", "comment": "Malware payload (Mirai)", "value": "aa91957e6e263b972608d0b8c031e165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283623, "uuid": "50e65344-472f-4a12-acdd-7f5479d52adf", "comment": "Malware payload (Mirai)", "value": "1bd61f2b5fec4f77c5a12ac5f3ba81b5396a3fabd886c3599e06b00569ad8078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283623, "uuid": "e496278d-55c1-4b5f-bfed-2ac0d7ca5488", "comment": "Malware payload (Mirai)", "value": "24b1d4a3bb4b23f0b0cc96155a06f8ed5ea70384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283623, "uuid": "e11ce10d-01ad-43ce-8a00-67f0c85e11e6", "comment": "Malware payload (Mirai)", "value": "34e74086677338aed7ef0ed32cd65c109c6785a3697a527909193526698d59ae783baf5238b100c867b89c01ba2e55b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283623, "uuid": "259911e6-5a7f-4f6d-8e77-9f4f83824eb8", "value": "T18A24F60EBB220EF7E86BCC3B05F91B05218C651722E97B75B974D918B54B24F4AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283623, "uuid": "612c5ee3-a37c-49a1-b894-3f0424e277fa", "value": "3072:mw8zSrn+aF1AV0OSxfreNws3g2wmbrD601um+xx3Q7myS/wr9Yaj:mHSyaF1AV0OSkfw2pXu0pkhQ7MwrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283623, "uuid": "d0ac8107-5a88-449e-aded-403fcc49d6cc", "value": 210648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283623, "uuid": "72d0489e-2109-4e46-a8eb-263c39f50c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283623, "uuid": "b49c1303-d097-4e28-af3a-b2c4462181b2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbee762-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312417, "uuid": "eb9367f1-67b6-4c44-b9a0-372eb983f7be", "comment": "Malware payload (Mirai)", "value": "8041c3e73d7c63c04d0ee90921cc5b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312417, "uuid": "8ae26c51-e92d-4167-bf47-aff56848bed8", "comment": "Malware payload (Mirai)", "value": "1cdd5b6af62e7c06bbe079cd571ee6887a31897e2b8b5842108b2dd5d79248b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312417, "uuid": "81f21ec9-59a4-4edf-880a-9c4df392243f", "comment": "Malware payload (Mirai)", "value": "4257128326fc28746419ef152300fca0e2c55794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312417, "uuid": "a02b43d3-6f64-4516-99da-4bba7b44de59", "comment": "Malware payload (Mirai)", "value": "85a6ea7f6a1ce01c95a762aac55c42a868c8fcf8444a04f14ccacd33f2d6afd47b1eb72e4973bfe4815b59e165270310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312417, "uuid": "68f8b6c6-f1e4-4c0b-b9bb-685c707cad67", "value": "T12B932951FC829613C6D512BBFA6E428D3B2613E8D2EA7203DD215F2077C781B0D7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312417, "uuid": "d30024d9-b95e-479e-a867-73f4fe3d98fb", "value": "1536:Us4pE2pQvF2zBQjD10ZVHxk6lMawkDouRN1qOdY8OfcjvkDqg+9fvRf:J4pE2/UyZViIMaVTRN1xVcaRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312417, "uuid": "ec154bff-8997-4992-ba02-c709c9c04c94", "value": 95824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312417, "uuid": "43d3775f-0d38-4424-869c-2bedfd866fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312417, "uuid": "1f3e1efc-2f18-4f30-b504-2ea804881778", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f61a577-5da3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780309222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309222, "uuid": "3a36b8a9-f96c-4667-ada0-23606c0e33b9", "comment": "Malware payload", "value": "a429b3ca00d9fdfcea1b6f311b37667a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309222, "uuid": "a3f668ff-dc9d-4b32-9471-0ca39361309b", "comment": "Malware payload", "value": "1d69523a20b9c1180bba6a2cc9959d555e2ee9e78440fd79cfbaf31ad35a09fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309222, "uuid": "e93e1d63-0447-419e-be31-11d809c74048", "comment": "Malware payload", "value": "f70102a8337acb736f4ab7ef172dfa3321d77775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309222, "uuid": "4a9677ce-73a2-4ae0-ad1a-4a0b2c8ebdc9", "comment": "Malware payload", "value": "b2ba8ae27ed30de9255e433c761859ab7d97ab99abf33a942d0a3d2bb62d3399c7b3513b56454ad84402542f35510d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309222, "uuid": "b5126b2d-7d46-4049-8f5f-f04cdb2a0f80", "value": "T1B1A43210F9EB940CB3775E2256ED3EBB0EAB7326173DA02C1004434B9BD7944DE5AB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309222, "uuid": "8e025cb8-8b44-4513-8370-bddecdb9caab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309222, "uuid": "cc3895cb-3ada-4ef2-80ad-a91aeeffcdbc", "value": "1536:8l8GfOFAIo1tLqu2UIRALEELurFqGiud9Aun7:8RlpqxUIRlzQK9Aun7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780309222, "uuid": "716737eb-817b-4162-9041-57c16154b896", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780309222, "uuid": "dfc629c1-674e-4bee-9579-5818a0c08b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309222, "uuid": "e509f5c8-e709-451b-aac2-9a09bc42fefb", "value": "1d69523a20b9c1180bba6a2cc9959d555e2ee9e78440fd79cfbaf31ad35a09fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff29bd7a-5ded-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780341219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341219, "uuid": "ddb32d7c-e578-41dd-bfa7-4299aec6e4d6", "comment": "Malware payload (BlackMatter)", "value": "b17b84a1f7ad1b62fe71a50d371d2874", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341219, "uuid": "d586e800-bcd2-456b-90ca-cdc916a26e3b", "comment": "Malware payload (BlackMatter)", "value": "1d9ba23a657f2c5eaea64c7a5aa96b628f0c23f371bfa6e74ac9bc9abc0efc93", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341219, "uuid": "7ac6d926-2d76-4904-afd0-7751372216b0", "comment": "Malware payload (BlackMatter)", "value": "95421f3ccc397c55fb7b9d6a24a352b1b4949f90", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341219, "uuid": "ea966c49-f0bb-443d-9c6d-f3ed2f511e34", "comment": "Malware payload (BlackMatter)", "value": "be648aae53eb03e1fa07d391cd8673702ee747be87ba036c44c58b5eeaa6436336a5ed7977cbde0a561c46eb432fdb1a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341219, "uuid": "73f69899-95f5-45ca-a93a-8970d130ddc4", "value": "T18DE35C21F262D0B3C83718F137267572F39E8E6C29A56847EAD80F5DBC648236F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341219, "uuid": "9752bd41-7d2a-425f-bf62-9ada1d04bc84", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341219, "uuid": "6381bd7e-35fe-4d53-88af-95102886d7fa", "value": "3072:C6glyuxE4GsUPnliByocWepkV9ARrutL8aLdn2hH:C6gDBGpvEByocWeqV9yudfw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780341219, "uuid": "0a544d12-d293-40a2-87eb-b2edb742cce3", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780341219, "uuid": "3733e556-53f4-4153-884d-4f4c722e45f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341219, "uuid": "d174c6fc-2bd0-4191-a0fa-1b63b5a389ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59f86f9-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "0676f71f-f484-4e65-9142-4e648d09fcfe", "comment": "Malware payload (Mirai)", "value": "3d783fe4c226282ffa5a9e58a79cf785", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "d9b04a50-f714-4078-b154-7f624acbaeef", "comment": "Malware payload (Mirai)", "value": "1da8cb5ae6ce618ec8d790e052802f5ccd880f0c84ce5ba9364df366640fe485", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "c0c8acc2-1a45-429e-b95a-5939f8abca9a", "comment": "Malware payload (Mirai)", "value": "00e8fbcaeae6f3ae0f9f68bc980aac20131c32bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "9d5d4905-e636-49bb-ae6a-3e574a5d99e9", "comment": "Malware payload (Mirai)", "value": "e1b4366ef21c08a51145540183a0abefadb801eb892517c22386d00ef2ae1ed3d0c89c6f1e4e6c359b19b1ca76a55a11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "a0ef5244-3d2e-47f9-bc39-6935ea6f8343", "value": "T15B23E09BDC605545CBEEAC357CBC43A55E20348A33FA97198B408E813AB584B68DC4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "91705ff8-fe73-4ac5-a210-8f4bcaffc168", "value": "768:YvNqQjJge6Pb7KY1aKzD+o6l5V87aFeuDFNQ6T3k5anZrXKWiB:Y17Jl6Pnv1C5VOHy93trXqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312400, "uuid": "9c47a759-c6bd-4eed-8e5b-4c18a2fcec1b", "value": 46684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312400, "uuid": "110bfdce-eea4-4636-8f98-e084182d571a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "790fa437-ea22-488b-8c77-c200f4c568c5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd37082-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780346799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346799, "uuid": "ed2a1ae0-ce4d-4a9e-9350-1e0affc240e2", "comment": "Malware payload (Gafgyt)", "value": "b82c9d382998298652014896646d92f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346799, "uuid": "5fb4c5f3-7792-46d4-9b4d-16c39df37cf9", "comment": "Malware payload (Gafgyt)", "value": "1dcb8c3d3368afe3512f5c65774178176c79a1dee30973da3cc4266f540060e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346799, "uuid": "d1d51cf7-f5e6-4d7b-b5ee-7ff6fa0c7b23", "comment": "Malware payload (Gafgyt)", "value": "8efaf4a069899d81887e8aac408edb84d491fb68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346799, "uuid": "cce22d91-b1d8-4728-8f34-62cbf11516c4", "comment": "Malware payload (Gafgyt)", "value": "c2b2ce01ed091faa758978f083691f5d6e47f15953530453122e5817d2c555c8056c45df9cb54286346381e70598cbb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346799, "uuid": "c80974c7-0ec1-495f-a27f-39a7451bd1f1", "value": "T1CAE3865E2E328FADF66C833547B74D24976D23DA26E1D684D2ACC1142F2039E541FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346799, "uuid": "85833a48-6c7a-4cdd-a8df-72413976a019", "value": "1536:MFvFKeuoZF1Q2s1O5HYRFSIT54YiMkzecYs3WJUWTK+1BhgOe6Tk4L:G9qor1Qo2TuYiMkTYsHajhgOTTk4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346799, "uuid": "9be845b7-3d48-4a27-8b3e-bf54eba08118", "value": 149828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346799, "uuid": "796b55e5-0be8-4cef-a289-7debeb3e7573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346799, "uuid": "46674d7b-6065-4eee-8888-a8138b33efcf", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb811b20-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346796, "uuid": "7dd646a5-3232-4ced-b543-ad08d6cee256", "comment": "Malware payload", "value": "0b3e5daebd05ac6ef557ab42751f818d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346796, "uuid": "d69769b5-6c99-4de3-b064-dac8f6b90048", "comment": "Malware payload", "value": "1def7d82f7bdf21fd4cf68b2d4fbeac5d01aee8a9a343c0772d13f2080799975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346796, "uuid": "5ec529a5-fb87-4165-8faf-482a06f5e6ee", "comment": "Malware payload", "value": "749bfaa8fc7afa7c883df8fbf5f7b9187872f038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346796, "uuid": "9ef32019-05b1-41b1-a70a-a5dcf15cb009", "comment": "Malware payload", "value": "38d12e0b4b0776392119855974879c663f227f44fc7024cc146efa89302734c27fdce03bf28f6f2c19f0528ec246e21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346796, "uuid": "1016d55d-f41d-4da8-ba60-70e95b9d8186", "value": "T1E2E3B81A9F910EBBDC6FDD3702AD0A0135CC945722A43B7A3674D538F64A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346796, "uuid": "47fabd8c-8150-4a87-a4b2-669cdbacdd16", "value": "1536:eFj+ELC524azKGdGUd4MjZ+sp1kbZ/5gTdnDGZQA3W5wuE49cmdoFX:CjjLjrMgzi+KZQA+wzQcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346796, "uuid": "ddc6f57f-3cff-45cb-bb11-14d288dc595d", "value": 150692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346796, "uuid": "a01c3dfa-ab78-4e18-b866-65897efb65a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346796, "uuid": "750847f8-82aa-4638-81c5-01f18eeabe1f", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a16919f-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780293724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "3cb05ef6-02a8-4d69-8099-f0cab788b281", "comment": "Malware payload", "value": "ea2c4bae81e174f2a496ef946442729f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "23821d53-7a16-413c-9ce2-37b4f474a3f5", "comment": "Malware payload", "value": "1f1bc4c569055f64d0058423daf292c67b5d106be577fe17ccb2d1b778b267b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "eeee08df-2830-456f-8d7d-185ec2f74500", "comment": "Malware payload", "value": "59e27574e80f876cc215c66af38d330279bf7fbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "d4d88028-3af7-465e-96f8-301e5f024356", "comment": "Malware payload", "value": "823609498da1a19319077d16d5328b10b39f5f89eb3ffef94a31bb62f09f1fb6bca1e7cadc6eaf9e081503017cfa1059", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "aed4fcd1-4f2c-4424-a914-3ff752c22bac", "value": "T168F04CE755B0DC3175B5C92DF99782E01147182728292509745F7E01BB2C98CF296655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "24763014-cd51-4e0f-8295-235d27df49c2", "value": "12:Zx80+albLeHt4ayzKuPfFFHshByuFNkjXfahx:gTaleHt4aIpnF1/ihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293724, "uuid": "fc25ca42-580b-4d09-aaa5-e91368bab8fe", "value": 615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293724, "uuid": "66b4865d-b279-4b6f-9fed-d0c84a68840c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "742caf24-174e-4995-a1dc-c2397eed0149", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19091ba-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780346753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346753, "uuid": "1e71bf4a-e3af-4473-b47d-25ba51f5f231", "comment": "Malware payload (Mirai)", "value": "59b7bbe6a29de1576a8b62168f48e4f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346753, "uuid": "d00cdc19-6f9d-4fe8-9096-1fa7674c0477", "comment": "Malware payload (Mirai)", "value": "1f92f98ec05335281ac746d097026fd89a14a3b74eadd37b9c02901339aed25b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346753, "uuid": "702af94f-e410-4a01-99dc-93ee38dd1f60", "comment": "Malware payload (Mirai)", "value": "3050320b1d62eb93363b93ffc14051f68717e4fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346753, "uuid": "d4c9a3a0-b211-40c1-a1e9-9473ecf377e0", "comment": "Malware payload (Mirai)", "value": "1e554442c7f603a186c5655143142e3239bbc165ed462b1b4a974219e2c0887fc3dae24733de3d5955c02c812a01819a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346753, "uuid": "494e81d0-1ccc-4b92-b00f-360fd232725b", "value": "T122E2F155C031ABB1CD7144704E04A9CF7B062AB4B6F9301361459FECB6AF98E1EBA48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346753, "uuid": "8e738ff5-538a-4ba0-8728-05551047cdd3", "value": "768:OcR39ilsXDco+OAyVH5UgTDM9+u2P2FcDqZgN9q3UELI:OC9TDco+Oxl9u2IagLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346753, "uuid": "4dc4113a-696a-45fa-ba19-a69fbc8a9d63", "value": 32620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346753, "uuid": "43462cfc-d391-44bb-8a41-f5063bb396be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346753, "uuid": "856f3aa9-7e7f-4667-9458-d78e88b386b0", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbecb00-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277809, "uuid": "67f14c17-9103-43af-b24f-ca3d587b8320", "comment": "Malware payload", "value": "cf102a3fd902182b8ae1ef0a6960833c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277809, "uuid": "a881158c-e7df-4ceb-97dc-029c109fb8fa", "comment": "Malware payload", "value": "221ae18668b9590038a9b0b4c2452520e638a3e15dbe7e07ef7580ccd3c1a9a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277809, "uuid": "08efe670-27dc-44e1-b2b8-19f5b7a67c8a", "comment": "Malware payload", "value": "e8d31f1dec6424de19b169092496b26499b8ddb6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277809, "uuid": "c0d68af2-179d-4930-8987-0cbe177081a3", "comment": "Malware payload", "value": "0b680455c74a1f8d2886d72942cdee8a06c1e9c8ed386d78cc456ab26ad62ce520e035a09dd8b302c136150536314a60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277809, "uuid": "bda64d77-0039-4cf2-9e70-ea594737af84", "value": "T1EC920B2537FC9B36EAB74F78E475C12412329B81A402DF191CAC60DE45DAF818021BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277809, "uuid": "52959332-7a33-43ce-a244-1930920c70d1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277809, "uuid": "3a2d0f9f-a615-47a3-aa54-783ad542b904", "value": "192:N0jOLvJtwGJDb13LljWQp2p5XL2Iz+iTuyeSd1SQrtHZcVSA2q+acmyv66cfjcRU:y5L29wxzJt5cVr7yBcLUEZsFi+Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277809, "uuid": "629586bc-c4b4-44c4-9686-0c3757f8885c", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277809, "uuid": "d7485336-3adf-4e27-b6e2-e690b345556a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277809, "uuid": "e1d10a50-090e-47bc-994f-50f987188321", "value": "221ae18668b9590038a9b0b4c2452520e638a3e15dbe7e07ef7580ccd3c1a9a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd32030-5d8d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780299988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299988, "uuid": "dc817445-2c61-4212-8ff8-a11efde018cc", "comment": "Malware payload (ConnectWise)", "value": "dc17b64229b8629cb79a961ff2725214", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299988, "uuid": "3fa1afa0-39c9-42ba-ae94-be9bcb112cd4", "comment": "Malware payload (ConnectWise)", "value": "22239d222140ba020bfc7cecec43dfb461a9cfdb446166ff02b7422d64a0b4ff", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299988, "uuid": "88e75e87-3655-497b-a406-a9efe2c97302", "comment": "Malware payload (ConnectWise)", "value": "00dbca864a16be473dbd96e9a3346ed4367a3fe7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299988, "uuid": "87fac95b-75ac-4d43-b30c-68c728453982", "comment": "Malware payload (ConnectWise)", "value": "f12ac38ca9f9196337f22cd66082572a71903c36460b613dd8686f26ec1ea9552c08cb38ae659bb9929d6371561055fb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299988, "uuid": "07b37ba6-3d59-4f99-8114-c41eeee9a6c5", "value": "T1E9646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299988, "uuid": "8c3e9f36-765b-4387-a98a-7839fbd3f6d8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299988, "uuid": "a63d9131-3b49-4270-9f1c-a5e29496c19d", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9e:Q1iw7gryNkSV1hy1Z1u2JLu9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299988, "uuid": "901198b0-0164-44ee-9f84-d3a10b12fade", "value": 312592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299988, "uuid": "80ee1c4b-550c-4eee-bb51-ba83e68f78ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299988, "uuid": "dc38143c-c157-47b9-9679-3d8a3956ddd6", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2358a3-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "78b60f0b-63ce-4269-8310-1068515c22ee", "comment": "Malware payload (Mirai)", "value": "b90cc0d475962e6eb77225d9d3336dbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "f31f0548-9aa4-4410-a19f-f1921808fb72", "comment": "Malware payload (Mirai)", "value": "2250f3ef0499e14c3ff16da2a0fdab67490ce64dcaaacf44761cd849f58ea015", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "ddfec738-51f7-4f44-84a5-014bbe12f86d", "comment": "Malware payload (Mirai)", "value": "215d8a5e66cec33ebff714d3afa60b8837cdd7ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "4d456289-2c2d-427f-9f58-3de509a22820", "comment": "Malware payload (Mirai)", "value": "fbd743161a2259fae980ee808fe368d52b37403a177dcd27eedae0d7f58e6d39d94980f48046a4ea7ca35a81e024dd8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "1c6f9f05-6067-4a1a-8319-6e4fd6e56575", "value": "T1DA31E78B236082FB850D8D5BF36450C4D0DF85D3E1AB8EB8F4A464625D5A00CFADAF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "11eb0690-5879-4b47-afaa-b2e4f765422b", "value": "48:/Nu7ZMjx215itPHvZvMOiVrKPvbKPO72vLj2vyB9g:FOe3Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323556, "uuid": "93875622-f277-48d1-8b96-adc8fb620725", "value": 1640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323556, "uuid": "e9ee2edf-3ab8-4edd-8baa-75010d3072c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "2cfb2a7b-a880-475f-9d48-a1566468f3ec", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6758d283-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "35b57ce4-f493-4dc3-907d-8832d6f4b9c9", "comment": "Malware payload (Mirai)", "value": "5b265b465247d08de8738ab2d50a3547", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "9de27041-f225-4637-8880-a629d2673981", "comment": "Malware payload (Mirai)", "value": "2369abc580dbb56d3d604b070485cc9be8382661100517151fed1761ac4ba4c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "351ee5b7-3b96-4582-b6eb-49118e034365", "comment": "Malware payload (Mirai)", "value": "71b612571ae607ff296e561538b0d100b9bbe0aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "3e3e7e47-cb3a-423c-8799-27212f10b60e", "comment": "Malware payload (Mirai)", "value": "5c59c2023710467052c7c75849efc64c04093847ec21ba7f245624b1f0f07a1fdb1de30a93a6eff40ddf4d92e54fdd6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "82f24406-fae8-4d63-af64-c7d480f74932", "value": "T1DEC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "69288c52-3f91-48d0-ba54-fcd79608b8b5", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPRO:LzhWutxBaORaebXQd+mzBzlkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293720, "uuid": "512209a9-8584-4272-8ee7-4461233f1cce", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293720, "uuid": "3fd77c51-bb5b-4de2-b1ae-b16c7daa96e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "829c6b1f-73eb-45f8-8af2-d7f82b75b744", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a96d1fd-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "6c3bddf2-7aef-4d89-8eef-074d9e1fd65c", "comment": "Malware payload (Mirai)", "value": "c1c5b71fd34be9dcbc6bbc5bec8c530b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "491ac9df-ed47-41b6-be39-a2f77112dc50", "comment": "Malware payload (Mirai)", "value": "23ab870dbce151ea72e0966114dacd7d0b3e436314c73943bc8d2ddf679625d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "4de5bc40-973f-41c7-b65a-b8b94f0490c7", "comment": "Malware payload (Mirai)", "value": "abee1f2fffd54576993537d00abc29dcb919e17a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "4baa0152-129e-44fa-ae68-4f14ff7c758b", "comment": "Malware payload (Mirai)", "value": "69add952ed789338ca0b82d0b8d8da9841146cd90ec230550c0c42077ca833f8b6c939844607561cb17161c36dd8320d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "c066ba9e-fdb7-481e-b296-1aaaa93c0cca", "value": "T10403F120DB699730D7719972CBAD06CE2B472532EB6FB87B05420F9D93F380265E5609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "f2db3b59-9e4e-422a-8bc7-0bc08a62ec2f", "value": "768:cageCHBrN2iBfJfdhF9IJ8yueni9OECDKN0P0XQWKdee7Phwh2Wz99q3UELOS:cageCdNlfx9qJ8hPVDQ0XQpdDP6XzQLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292329, "uuid": "d9bd0e94-5380-4d5d-85df-8ae78fe5e186", "value": 41392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292329, "uuid": "0a44be61-a887-4c73-95c5-8003d171b849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "7f9a54c6-edc5-457a-a5e9-1881cc95877c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43100866-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "87c54f53-9f53-41ad-9195-5312a9b955ce", "comment": "Malware payload (Mirai)", "value": "1f684587d0fb71253d078c1a56231355", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "8ebda07d-e83b-4213-b570-ecaacddf23a3", "comment": "Malware payload (Mirai)", "value": "24b775cc1254f544ad0a1a3bfc1f2f7416a6b25b1eeb53e27889b3dc432d4ff0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "6d7c3b29-b60c-4312-a0d7-039c530346fd", "comment": "Malware payload (Mirai)", "value": "b90006ac9f481964815ec3a73f4100582645bab0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "da668d09-b761-487a-89a6-d479cab48c09", "comment": "Malware payload (Mirai)", "value": "13b107dfab582696f0084e1bb7af77c69948a1388a19a46cd936cbfc4e36bd37c1de237a1bdaabfea906508b9b79e4d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "53634a2f-153d-482a-af03-b6b8c3d76d51", "value": "T127C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "9f8e3e39-b933-47f4-b4a3-409fbab9c25e", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMhfN:MwCvdHmezn0nUPMu9KryXsMhfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291511, "uuid": "b6dff0b6-089b-4fe3-9c2d-5bdfb5f2f534", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291511, "uuid": "2e8397c2-2de5-4841-a5ff-03b937278ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "fb2eda44-5ceb-4512-9ec9-4a77b3a1cb42", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cd5792-5da2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780308961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780308961, "uuid": "5fd3933b-6b6c-484f-bb9c-313d3d3a0d82", "comment": "Malware payload (njrat)", "value": "29de3d2077088da6f75977119f9973f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780308961, "uuid": "968c6659-91b5-42e0-89a3-90cc195d2dfc", "comment": "Malware payload (njrat)", "value": "25816fdba80e4acf6c2ab180bf1a2ac7a5a08ec2a9cebab8c1718353ce97f1a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780308961, "uuid": "84732bcd-fed7-4f05-bd34-38d403449c81", "comment": "Malware payload (njrat)", "value": "f81648e65459649702f4d941a5e8a3e496ccceb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780308961, "uuid": "1d9ce990-8614-4605-a11d-cbf6127aa39a", "comment": "Malware payload (njrat)", "value": "c6fa8676a281d47b5a2af4122dedb50b2c6cd4285734d5ebb02f312d0ed043844d1ae2f1e2f645f622ead8dbca9f680d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780308961, "uuid": "7cda5b15-492f-4dec-824b-5587bc53f0c4", "value": "T165F23B4577904321CAFE6FF16EF3B1090274E50B8923E79E4CC8899A6F679C289507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780308961, "uuid": "7fd7571d-d895-4ba2-b624-5cd7aef9d723", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780308961, "uuid": "974aa362-34fe-4437-984d-d2464b2f4954", "value": "384:HImX42qeOsp+5e7ZYaLVquWa6nDbghLmdZCwvHixdTH2VR8pkFTBLTIZwYGDcvws:7XHYasu0INgZC4CuV9FZ9jDOjh8/k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780308961, "uuid": "fdd72f45-6dbc-4676-92ea-a15b79fba81a", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780308961, "uuid": "ffd681af-c84c-42f2-b9ca-02bed8ac6a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780308961, "uuid": "699f61e3-2559-4aa6-b97c-0896652c7ac2", "value": "25816fdba80e4acf6c2ab180bf1a2ac7a5a08ec2a9cebab8c1718353ce97f1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ff927d-5e0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780354807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780354807, "uuid": "8d7b117d-7dea-426f-85fe-c7ea16da7ff7", "comment": "Malware payload", "value": "810c38045ea8faccb79c877befc0f2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780354807, "uuid": "484ff237-50f3-40e9-8c38-ca4fde89640f", "comment": "Malware payload", "value": "27f8be17cdc13a16c8462a8bbef82f265c53f6fed2c2a2cecac3397f2fbe8efd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780354807, "uuid": "1e252c12-099f-496d-a398-57e5c40c82c9", "comment": "Malware payload", "value": "f3e574af9477df7670eb004af541f8608244b348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780354807, "uuid": "323fa986-cb10-46a2-a217-3cb9b4df2892", "comment": "Malware payload", "value": "c87c3c5d28ef3d649f5d56c547c39b553bd8903e17ea47dacc4d0e4673ef206e9b6c165ed84a7be5e60a88f284f5e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780354807, "uuid": "ba6e99c1-3e88-47dc-9f19-c2b45d8e23d4", "value": "T158763A227BAC8E61D86E13310D8BE9B46172FC45AF1741873229B76F6A73FE0181175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780354807, "uuid": "187401be-1a81-4972-a9e6-470787520a2e", "value": "2d9e242960f84bc7c78a2273ba553d9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780354807, "uuid": "f8f12677-4a93-4f0d-911d-758536c79db2", "value": "24576:8B1FhWvWpYHfOoJlCBsK4+PwhLX8mgUDt+wldjYWsPwqD4Dw4ptnksbUqwrQmO7/:8lg52vw/CJLyYd22OcUNe99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780354807, "uuid": "b536592d-06c3-46d0-b350-8a7b9af45125", "value": 7143424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780354807, "uuid": "8b14dd7c-1d6c-4090-a835-69f99d3ec310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780354807, "uuid": "b25fd391-f694-48e1-b42f-d7daa56d04aa", "value": "z85SCTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc8a004-5d84-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780295854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780295854, "uuid": "385899fe-51ba-4989-9daa-933c052b0994", "comment": "Malware payload (Formbook)", "value": "4f4dadab92f272f88d5f9c32b0cb1900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780295854, "uuid": "4c13a969-50aa-4f6e-8b5d-62c950db2b46", "comment": "Malware payload (Formbook)", "value": "28278de0514cbae5672f69ac20e42144483c5a6eef2af6778dae742446ca3760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780295854, "uuid": "0a6ac232-055d-4ee2-870e-d5aac909a10c", "comment": "Malware payload (Formbook)", "value": "e9fb47e8943d953db64424bc735831297821a769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780295854, "uuid": "a1aaf056-d9ba-4d20-a761-5226ae6e59ff", "comment": "Malware payload (Formbook)", "value": "487671eefaef721282a849b659ab0dfd178eb06bbdfee0502aa0fa94333980a4605a84d8ddf940c56deff074f8faed06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780295854, "uuid": "2587c470-8476-4580-873e-4cdc3c1fe1c6", "value": "T1663512153B19DB02D89A07B90970FBB213BA8E0CE521C7275FE5ACDF7C2531A6919393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780295854, "uuid": "5d54a123-89f6-43d2-8e0f-a8d5d7a76570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780295854, "uuid": "01dc6fdc-bbb4-411d-8f99-71a0ebb85b6c", "value": "24576:+AtO0L08+gLRZzbVWh2p0OzM87lGI/OBU2vstd1pm045foI:+AtO7dSpK2p0OzN7lH/GdY1p145", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780295854, "uuid": "c016e933-807a-4145-815b-3ef2b8ee749b", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780295854, "uuid": "ccb7bfdc-5a8c-4a14-b2b7-537ad132f98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780295854, "uuid": "657fbe0f-73fc-44c5-841d-4f5f1d578584", "value": "a26a-d031ee24fa85.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414df6d0-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "54d6597a-e766-4540-947e-e82e2a4b22b1", "comment": "Malware payload (Mirai)", "value": "860e13e90b75ad8e3e95eac6f602bc72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "d247db86-51e4-4087-817a-a7c0731050c9", "comment": "Malware payload (Mirai)", "value": "28c19597f28e570271f81e350be0239eb1649e38ab553ff8221331346db31f86", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "355bed93-d510-43c6-952e-09bb343abff0", "comment": "Malware payload (Mirai)", "value": "48e1c55b33836af20fcb2fc563c72442431f98cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "e9baf876-ffba-44bc-b342-5f99a990b292", "comment": "Malware payload (Mirai)", "value": "6f01740e0a6217d2a449f024e663c777dd549d91bea45e17d5b19ef7f1972e7fe8eede1de61615a9c8b8a234b21fdb18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "a3ee2f47-84da-4b94-ac60-e6cdd3299d07", "value": "T183932894B8419A17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "e9ba1fca-6573-4a7c-ae20-9a25de992c13", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2u3:AGUJtkyYEETn0T32TDBf0nsX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291508, "uuid": "9219ea5d-078b-47a3-a3ec-ba51c30675ce", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291508, "uuid": "bc4cc115-fcfd-4555-8ac4-a9df243804ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "2d1350da-e79e-4ed4-aaa6-ab176b4cbc9d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b7afe-5d57-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780276687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276687, "uuid": "c3c82bad-d56e-45e8-a18c-5c9c175ffed7", "comment": "Malware payload (Prometei)", "value": "7da76e86b1ed9c41e50d326b0becd978", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276687, "uuid": "fc5f785e-02cf-4357-ae10-5779173bd8ee", "comment": "Malware payload (Prometei)", "value": "29a1e5bba4e3895c23bc57b48d34e56aa9564095b192b7af1a98b598b7ff3f20", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276687, "uuid": "c3f8fb8e-17da-49c0-88b0-5e68528368be", "comment": "Malware payload (Prometei)", "value": "2f1abbf7a92ffbe0d8db9ae7529396df87330a13", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276687, "uuid": "a8c66ced-da8e-4b07-8d5d-6da82dbb9676", "comment": "Malware payload (Prometei)", "value": "37bcd57a4d07f84e405464de6389e1a0bb7a6768181d3aea62c5d2176001e7f2091c42425be7343e4cb62cafb55940eb", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276687, "uuid": "e64feed1-d6ab-47f1-acfd-788d3ca5c79d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276687, "uuid": "838c4154-471f-4ec3-8d7a-9da58e5103c4", "value": "3:B5OWEn:fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780276687, "uuid": "7bd36791-ac40-454d-81b9-90421602ff1e", "value": 13, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780276687, "uuid": "6bea1ed9-117d-4b31-8dfb-0b48aad17c3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276687, "uuid": "827a3cce-2a02-44a2-a981-aa44907e935c", "value": "29a1e5bba4e3895c23bc57b48d34e56aa9564095b192b7af1a98b598b7ff3f20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0d37f1-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "72a43e6a-8a68-4df6-90f2-890f03921d64", "comment": "Malware payload (Mirai)", "value": "c37d4f9d51e195c162132ed5d4face36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "46f1d7bd-7051-4ec6-9254-daf9c3fba3b1", "comment": "Malware payload (Mirai)", "value": "2a646cf7ec8b483400fa7f3aff6f3b0111ff404f48baf2a013949004849e5ee3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "8f54d236-d621-4fe6-a256-399d3c509582", "comment": "Malware payload (Mirai)", "value": "1701fb882bc2dd5020e4b3488a6eed4c202089ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "97f300d3-ba7b-4d70-ba0d-75a9e328b850", "comment": "Malware payload (Mirai)", "value": "6a0db90559226bc8cc6b80542b859135f70c035291f3cc352c8123c2625a115bd5898bd69676beda662314a8528201a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "062e4234-8112-48b1-b2db-1f99289d2297", "value": "T1C3C37C9BF2476461C82447F44BCFBB9D2A6321024E2794EE7C1E377A2A375DE58063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "48a06ba4-5da2-4f31-acf2-96a736b986a2", "value": "3072:bRU4eDf3NC+xcQKFFY/LyRqYNvgxCt2U+k7e/Oq0:NXmNRpKFSDy4kECt2Ud7vq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292895, "uuid": "f04cdfd3-4a20-4d8c-8a9a-2fc6e6040d58", "value": 124616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292895, "uuid": "cd064e94-06b7-4836-a5ce-93d6983f0f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "ff2b32c5-6bc8-433c-8cf4-e14a099bf64a", "value": "bot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698f49ef-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "976e3e65-f53e-4f52-97db-0e872299d212", "comment": "Malware payload (Mirai)", "value": "db8fc34da074773ae3f6dc029052aac8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "94a91588-09d9-48fa-9395-d4cb26d3adab", "comment": "Malware payload (Mirai)", "value": "2b1f532400bba24fd9043cb9db904a7a360ead77afed7a1cbe631ac19bcbe9f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "4edf4f53-9bec-4ba4-aaa3-d1a8984bea28", "comment": "Malware payload (Mirai)", "value": "ca933a68a9a4afa9cd21a19d34163b3b6fea42c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "bb07a4c5-27ec-47ac-acd6-7dbb5a7a0a46", "comment": "Malware payload (Mirai)", "value": "db5277a17d0360a510ebdf52ae976d2f19283bf82f4f818f5da9979f1bcf80d85436db73a2e90eb1ad132dff4ee0bedf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "4a73fc8d-05dc-41fc-83ba-843a187049e6", "value": "T131A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "5046256c-628e-46f1-bcd4-0c7855639733", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0o+j:bbbmPTO930bkbRl886+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293723, "uuid": "1e7040d3-b947-4ffc-a0bc-b5405186f974", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293723, "uuid": "1a800533-93e9-46d0-98b5-1f3094d9d3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "2022d0f9-c87a-4ceb-970a-9d5225a60f2a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab05106-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "1209ca4e-190d-4b50-908e-56a9e2d651ad", "comment": "Malware payload (Mirai)", "value": "9064699e021054c69f18ed94d8ccc4e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "b127d14f-b6d3-460a-bfc7-b306c0a9f946", "comment": "Malware payload (Mirai)", "value": "2cc14c04ab566cb0d3a3778d76cc263e0b75c504f03af3b6b464a1366dbd5044", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "cd7e3a63-1965-42bb-a037-3613dc8f3bd5", "comment": "Malware payload (Mirai)", "value": "2d6043750d1d6943bf365f99ee1c6f5a2d6c8633", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "faaf2dd0-d2f8-46d9-b7d1-8578eaaf32bd", "comment": "Malware payload (Mirai)", "value": "00f1e874fcdcc29283bc9dd5c41fd48bd3a977a138fd2de3b102c1652737c19f07bf06b795f1a3f39689602b4e1c9be4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "dcae00a5-22d3-466a-a955-58bf481f9e81", "value": "T1C1F2E1A0E7860EB4DF5BDB748E53DE8237D04A5823A3AB417085DF051A07096B62BFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "a1540c9d-5747-4ae8-ab7a-b68c45e405da", "value": "768:KeDVCKyXQlL4eutJvYoX6sE4528WzbGyHMvuxz0EsnPc4uVcqgw09w:PDIKyXQlkeUBYoX64WHvM2xQEsnPc4uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292329, "uuid": "49e42f70-f5be-48d1-b9e2-43284dabec4a", "value": 35780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292329, "uuid": "67589522-d76f-4672-b4bb-dfc810938d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "ea4583e3-cd9e-449d-a5e9-f5334303c608", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44e7649-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297687, "uuid": "8c435fdf-c997-4051-9aae-ece8dd378b5a", "comment": "Malware payload (ConnectWise)", "value": "637f30d49e1e8bf92a7badaa0df89d75", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297687, "uuid": "aeb3b0cd-d9f8-4cdc-82fa-13be41563725", "comment": "Malware payload (ConnectWise)", "value": "2dc8d2dbc4cfe2ad52064eced38260bb5141b8138cfd76ae3a4ab353399696ae", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297687, "uuid": "2c8f3321-1502-4e74-a422-aaf0fbf8d311", "comment": "Malware payload (ConnectWise)", "value": "26ff78cae6124ec5b8067c9e73c92cd34107b280", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297687, "uuid": "e298aa9f-c5c6-4f37-8ae0-61af9a043665", "comment": "Malware payload (ConnectWise)", "value": "a693b6fa53ac6b96821a43dec2409cf3f0a694009089c0fc53c828e4064eeb62cbf8fa08265a9a3da6b7bebe20eaee74", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297687, "uuid": "f75e4d08-2fa3-4f06-ad90-75e0e44b2319", "value": "T1D4646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297687, "uuid": "46aa1264-f231-430d-836f-5ccc795bc8bf", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297687, "uuid": "50502fe7-1509-40c4-b609-3b3fed30ef26", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji90D:h1iw7gryNkSV1hy1Z1u2JLu90D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297687, "uuid": "14bec49e-ff5e-46b3-a4da-7cb79cad1e33", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297687, "uuid": "7f359619-270b-42fb-8109-84a4b2487086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297687, "uuid": "46dcdbfa-10f1-4f64-a644-da3f23051df3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066d641e-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322333, "uuid": "3709ac0e-8241-4d5d-86c6-48ca4790d73c", "comment": "Malware payload (Mirai)", "value": "b81b35416865db27f4a21e1628187826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322333, "uuid": "939d2233-e94a-422a-bdad-2314fb2cb431", "comment": "Malware payload (Mirai)", "value": "2e9292bb559c512efd0407ce24cff68971c872a0942985df2ec776ee73ae2572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322333, "uuid": "dfe3150d-ae86-4839-925e-6419c62cb813", "comment": "Malware payload (Mirai)", "value": "148d8580a0c734002a2b6ca078891b3191e19e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322333, "uuid": "d0589fea-5adb-4d3b-983f-5380d539fd27", "comment": "Malware payload (Mirai)", "value": "b502c672b6df1c6516ca8095a313f64505762471c2e469cf516d4bad51a1f2f99ae66111a926e30efabc123fff544ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322333, "uuid": "188661fe-fabd-4e8e-995d-2e1b0b6d4596", "value": "T19EB2D0241D445960D6B89C339E39C68B3F9A017CF199B0B63891075CAEC15A2AEFE3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322333, "uuid": "4aca7a00-7e48-4755-aa64-ba3784a94fba", "value": "384:tkksV8889DEvfmn0lVcdw2qVZHX0dsiQWIfAVgUd2EFTcUmRIfp5dhymdGUop5hw:tk5V8n0fQ8OwNHXfiQWIfotPF9++5dsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322333, "uuid": "906ae5aa-4810-4f20-970c-bc461cca7aa8", "value": 23812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322333, "uuid": "adf59fb5-f16a-45e1-96c2-677882f56b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322333, "uuid": "afd2c3fb-e8c0-4e24-8474-7977ad9a3d40", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e02bbcd-5dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780341405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341405, "uuid": "7b30ebe2-94cc-4dfb-97f0-74304a590e13", "comment": "Malware payload", "value": "b43af275eb92858a3a9cf0f57ae0ce4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341405, "uuid": "fb9c5666-0401-49b3-968e-bf99c89067f5", "comment": "Malware payload", "value": "2edc59c543b65ec577377be3034eddf4079bf117532bfb83321259151648d9c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341405, "uuid": "3a3ed696-6dab-4789-a955-adad53f56898", "comment": "Malware payload", "value": "960f09fa7c267632cfcbc3616ee8f244d4b6b3e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341405, "uuid": "82e524e7-a250-42c9-94a0-9d66255e8d10", "comment": "Malware payload", "value": "8ad022cd54845b843efabca741b8d648cdc2dede7076041f4e0a884d4ef314f1be49b6c3f455e0f137ee48afffb4e588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341405, "uuid": "32581456-aae2-4a3b-a51d-e3e32fc0fc43", "value": "T1BEB66A137B6CEB0FC22822340DF2DA946B695C9601D7A517B285F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341405, "uuid": "b5a0eff9-0c2d-4405-be61-3b2f861369f3", "value": "196608:yp2o4msp+R4KNEzNC5GvGzwsQqNMJqrnv84R9+9Ok/QOLDC:yp2o4msp+R4KNEzN+GvGzwsQqNxrnvLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780341405, "uuid": "8d438ef0-2ba8-4dd2-8283-77880d64ddb5", "value": 10964597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780341405, "uuid": "f4f0f1fc-cd32-45b0-ae2f-ba6f822b2649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341405, "uuid": "f6143e6f-b851-4d37-903e-cd6383f15306", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442268ab-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "8eb43daf-330e-4ab6-b019-080dc0746f4a", "comment": "Malware payload (Mirai)", "value": "17d9aecbcebebc9e42872d93be843304", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "12f70b28-d216-4222-9eee-278eb3d6b896", "comment": "Malware payload (Mirai)", "value": "2fa0a0110d49a2324f7bb3e82fb490a8b9aa44767c0d8a71230182bbceb567a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "fca47896-e95c-4108-b01b-73f2718ea1de", "comment": "Malware payload (Mirai)", "value": "47ff2cb8056f1842fd2a106c3dbcc077fecc21b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "85edb74b-f2bf-4deb-80e5-8a06761e2cb4", "comment": "Malware payload (Mirai)", "value": "27f49b05d945ac9d4a7ba85182b2d97a3500213307f3fff674f07e6d908a85347f77179e78fa3731fea1e7c5f8cc8544", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "7f95cc30-f77b-48b0-933c-9247dc801af0", "value": "T18C933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "6bf91e10-6a16-41a3-9b18-c69009619a7a", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LwiR:KvjLrKGG4syfcIhXiuxpUN48Lwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291513, "uuid": "483a45f7-f2a0-4823-b3be-7eaef4398b29", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291513, "uuid": "3e7020de-611b-4d84-b34e-503e133dc78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "e2e47866-97dc-4f5b-9a04-4de8b5abcd97", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6665b12-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "ff73972a-cc4e-4a88-a7e8-26ad4cf2ecbc", "comment": "Malware payload (Mirai)", "value": "6099e696850753bd496ab6231db2a111", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "2484956d-ca90-4ec7-87a0-61e87b4c0593", "comment": "Malware payload (Mirai)", "value": "2fac85485bf728e8a209f5a65836aef5597a9da055b11b11913278c6d9629e02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "3b294b93-5e47-42e3-b7fd-425cdd8b3b71", "comment": "Malware payload (Mirai)", "value": "0a004e970228a1f1c1e0466a847de24e223a28ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "1dc1ea92-cfc7-4142-ad66-a0bf4765c836", "comment": "Malware payload (Mirai)", "value": "d78d10b644a5577a5e4fe8cb3412a043f7b1377e88d7ccf97537a815867e9a285e1d2648d807eae84755922dc5156ae9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "fdd48002-9a89-4559-afdd-7d6ea3489a4e", "value": "T15C934A22BA7A1D27C0C0A47A21F34725F6F247DA25A88A1B7D710E8DFF256503157EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "a21d5514-2b74-4e1e-9490-2840ba2c6ab2", "value": "1536:S9hBSkm9wX7HSmt2XxJGJd7hnLJpshoHHtt6bN+S5Dvd3iEychotPFP8:S9SF9wXj4yZT1tcbNVDv01tx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312401, "uuid": "ebcccdcd-5a21-4d22-9cb9-ad9deea2ef4c", "value": 96504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312401, "uuid": "ab91ce8d-f39b-4a1e-ac1c-d4383df00432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "9e6913d3-3187-4955-bec7-0697c80587ce", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54054a86-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292399, "uuid": "88cb62f5-e1d0-4206-9adf-1b2ec5a74151", "comment": "Malware payload (Mirai)", "value": "0994d7def78e28ff6ece34ad70b00dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292399, "uuid": "0b129c1f-5973-4bb7-9224-fcca9defde62", "comment": "Malware payload (Mirai)", "value": "2fdd50fa27c06903facd33f94633edae16ea7825847d79a8d1344cd0c081ccd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292399, "uuid": "f05a5e58-16aa-49a0-a0c2-e0eb312a15a0", "comment": "Malware payload (Mirai)", "value": "0ef2c2f023354f3ce9112c436c9a7a8e42f041d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292399, "uuid": "2a0fcf7e-9d8e-4323-9e8b-73b5730c47de", "comment": "Malware payload (Mirai)", "value": "a58ea7b2acc7abb7c87f430fe97de82913fba916a55854d2f1de82c1e3f8877ffb9401fcd67ca1914fe6c9ae61bc7963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292399, "uuid": "8a630cc2-33fa-428c-b702-8d0422ec6f10", "value": "T181A33A45BC819A13C6D5137AFA6E428D372623E8D2DF3217DE215F2037C682F0D6BA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292399, "uuid": "1872f7e4-010a-4879-9937-d1edb8bb4928", "value": "1536:IfmvRsNLS9WpzrXnooQPPhxihbjWFEMqNIonO4eTwX13nv3d:Smv9MjWOHar+53d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292399, "uuid": "b3016ec9-312e-4870-9ac4-fde82145e097", "value": 104848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292399, "uuid": "a305f1f2-9a4e-40e1-b1e6-edc1a3e9da74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292399, "uuid": "b5f5de74-1992-4038-8050-752b6b9c197d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ae0014-5dd2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780329605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329605, "uuid": "c4e8d42f-d0e6-4a5c-aeff-1d467c5cd13e", "comment": "Malware payload (njrat)", "value": "a7c2dcde577a21ef4d91cf0b5cdd39d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329605, "uuid": "d30a78fc-70a6-4516-9475-a9263805a1b3", "comment": "Malware payload (njrat)", "value": "309ec9ea0e7c9580b181da9c4c87dfce070912789b6e25596f85e814292daf28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329605, "uuid": "b416017c-c3b4-4b66-8fa5-c9f47f424ef9", "comment": "Malware payload (njrat)", "value": "f54e06798cd8695bba3da74272df9c3f22814369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329605, "uuid": "eeee0104-f3e5-411d-a2c7-7c71e4a479d6", "comment": "Malware payload (njrat)", "value": "a2640f782db66adb3366b15f78be208662e515a68dc128d443d9f1b72f7d5c5ed87a5877809d4bb1579d89dd032691ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329605, "uuid": "12a8402c-1c05-457a-b485-579c15cfb5cd", "value": "T1821501253B68DD01C9FE077455E0D33207B58E09A212E3269EE4BDDB3C767666B1B283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329605, "uuid": "6cb0d77f-bbfb-4d4c-8ebf-f99ec1fbcaef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329605, "uuid": "80a80ee3-0cf4-4ddf-9ce5-05932c969082", "value": "24576:PzZeyykiEtl3UzfBakLhRtAP44fjJBaxeBs3FXef3cVP8+g:rZ46tN0f71RiP44flB0eBag3UPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780329605, "uuid": "d7646c7b-73f8-4bfd-adcb-3f5cf6b492d2", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780329605, "uuid": "23715c30-9b7a-4b06-961f-7518bd28a046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329605, "uuid": "07805768-e70c-4a6e-9f76-85647b847d32", "value": "z14lNV-9088759885926.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f0dd10-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "1761a264-6503-4f9c-90a9-2a5aceab7391", "comment": "Malware payload (Mirai)", "value": "5cca4668669a5cf43f3475aad388e05a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "798b85f8-89d9-4b38-9efa-c31973016890", "comment": "Malware payload (Mirai)", "value": "30c34a2a069d58a6c2766fbe70c2c41687f4c37965c0ab9d7fc5534aeb53e240", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "dc6c3fe6-2a6a-4e58-b10c-69300483f30c", "comment": "Malware payload (Mirai)", "value": "9b109d3d34a13b5219733f7ef21f636916e25024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "d2c6fc60-74e4-4679-a48e-4ea1e60bef13", "comment": "Malware payload (Mirai)", "value": "e60c1b23efac6f2199f3c49f93b7f250bd6ee9a464fe79a0458a80d4b08d579efbbb27e2a1583e20fc1407b1584f7bec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "1b1b671e-430b-47dd-ac49-9092a0ce2744", "value": "T198732B81F54B80F1D847487090BBF33FCE31D69541B5D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "8fd838fa-a8db-438a-bda7-912ec4cc159c", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHq:uVFrPNQn+WVQ3EXVUk29jgxOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293721, "uuid": "40b327bc-c7c1-447a-b8f3-5920de913ddf", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293721, "uuid": "3cea8bbc-b625-4cc2-8b7a-884e33bfcff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "a5762270-8b38-4a31-80c5-d27454809dae", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6010ba0-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780293825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293825, "uuid": "e283da07-294a-4dd2-ac94-93071ec19417", "comment": "Malware payload (XWorm)", "value": "5033dba63f24df4ccb297063731e6152", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293825, "uuid": "e83cb938-0d52-4cfa-925d-56eca28d17ad", "comment": "Malware payload (XWorm)", "value": "30ded8132af61b659fed8f7cb246ac33ae92821241d14a427a53521b331df877", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293825, "uuid": "be71febe-4db1-4958-9ea1-04e382e79d8f", "comment": "Malware payload (XWorm)", "value": "272e7cc8504b4866422bdc787cfc388f77ebe6b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293825, "uuid": "56baed90-0b07-4f28-b75b-63c0ec63a76b", "comment": "Malware payload (XWorm)", "value": "2b4234b96f85f5019b9ba0340c208aa5777dadde45fb00445501b871ee86493be1dde69737c49f81d2fa47b2df86e00d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293825, "uuid": "c335e8ae-5ba5-42a0-92c1-7b62010daaa8", "value": "T1FDE51B000616E2B0ABAED31CC536A720190F241764F8EF5D71AE923B7796E53636F5E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293825, "uuid": "46e6a1da-9c0a-443e-87a1-cc138a544928", "value": "98304:rYLO/xVPvShDMZO1T/LcGzE+xIxBE3mIh8NGVZnI7p:ULOfPaRMC94hUVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293825, "uuid": "83b5e39d-c174-4f22-94ef-91abb20a49b7", "value": 3194898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293825, "uuid": "1f1a03d7-d8b2-4eb4-b3bd-e860690e8210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293825, "uuid": "2c5b9a8e-cf59-4ea3-84aa-93d93355dcdf", "value": "doc08499520260527072150.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04e3beb-5db8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780318431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318431, "uuid": "a4dfe396-9543-4d6d-9d11-f3f4b0e7e14e", "comment": "Malware payload", "value": "323af631ac1ca3f54a8672ca5464aecb", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318431, "uuid": "c00b8436-93f4-4110-9521-9236f36b10b9", "comment": "Malware payload", "value": "3184c799a516c98652c82ea88d38da885c55351300611cef953cacd33df9942e", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318431, "uuid": "8c1f33a2-8263-408b-ab7e-f8bf41589369", "comment": "Malware payload", "value": "d0b90795987c3160bec7e2e750edce6de055ae33", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318431, "uuid": "89fbb1cb-eb3d-49f6-9305-0a250a7f4673", "comment": "Malware payload", "value": "3d56c4e9ba9524bf03ffd650f95b84b5aa4e2bb7e31142eeed0bd35aa8f41b5e8b546609db2f1a7f7c0852f914659a11", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318431, "uuid": "f3c56f60-be1a-43c6-9fbe-4595f3c4915d", "value": "T15865333377AD01F171B90A2A8AF2D35ED4702246143A6FF95C5137FCB69E2A12B5C8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318431, "uuid": "9809ca2d-3ad0-470b-9bb4-3b1b80655aed", "value": "24576:NhGxtMC8WfY/Pr0rQs2oXs59wyTS7dHQlxrKG0r3BIOKi+ulvUHhdfxq5ZNxWxGO:Nh0vfY/Ir4o85XhHrKr3iO6uuhF+4xGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318431, "uuid": "4a38947f-cf4b-47b8-9687-a82b6af5bf9c", "value": 1424364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318431, "uuid": "98af21ad-6644-4391-af80-8f4caf146e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318431, "uuid": "576425ba-02ce-4c89-8bad-9a8e38662f78", "value": "check", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb41bca4-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312436, "uuid": "450bf537-52d6-426d-88cd-40c1a47566f4", "comment": "Malware payload (Mirai)", "value": "545ac1d0ecb80db5140fc8be6e7c47ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312436, "uuid": "a37bb771-36b9-4441-9c5f-d6564d89fb25", "comment": "Malware payload (Mirai)", "value": "3303b5905c1db31f011990051c49bc7f2f9170826883103323f40d28ce51fe1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312436, "uuid": "91332542-96f8-45d2-883f-a62ae4c2c219", "comment": "Malware payload (Mirai)", "value": "12f2d0e3f0680b2218518c8e205cf95c6121aaf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312436, "uuid": "9169f850-887d-4315-8c13-fe687fd90559", "comment": "Malware payload (Mirai)", "value": "730099b0fb0a5e793700c3b2b39fc66dfa81660236ac6ee927b1e08e377aef499bcb5f286e026b7ff3220e89e608a853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312436, "uuid": "fd3c8f87-db78-452f-86dd-e079164251a5", "value": "T1E5736DC1F743D4F4F85704702277FB3B1A32F1BA112AEA47D7A89A72EC52601E91669C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312436, "uuid": "e9c31d56-e933-4b67-8c2c-8665c2e831de", "value": "1536:LuUTFqS81l4OGv9p3XPUhOu4FRbuiEPwvNP3IuHnUCUHjUKtgShy:LuUxqS8frGv9tXsh1PeNP3jHUNDPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312436, "uuid": "94a844c1-48eb-4045-918e-dd0d6d31f321", "value": 79248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312436, "uuid": "a3998039-a9c6-4df7-8aba-af3e30fc4a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312436, "uuid": "3cbcfad6-9d2a-4a77-b6e6-49ea8a76d72b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fb9f50-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300027, "uuid": "35452f91-2d2d-44c0-9066-d0c1b78796c0", "comment": "Malware payload (ConnectWise)", "value": "c429cbc99faa237829e6a53ddd4947bb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300027, "uuid": "30c817ff-2c5a-4345-81c7-94f9c9d9e827", "comment": "Malware payload (ConnectWise)", "value": "33bdc3a427ff70b08c467f3f33161e36a94ed856443232b561cd6fb966d7ff17", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300027, "uuid": "24176612-6cbc-4049-8afc-3b0b7d216b95", "comment": "Malware payload (ConnectWise)", "value": "6770950e784a9f4a4aaea75cf6d9d68c2203d4f8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300027, "uuid": "c509c24e-abf1-461b-9bdd-dde73dab452b", "comment": "Malware payload (ConnectWise)", "value": "55a28ba4bcb356ea7a199f08cabe55dd3c1304e216a8d82e5e10ca5277cc2919eb03cbb95b62ce9fd7fb813f512e4e73", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300027, "uuid": "b72e6e50-32ad-4f43-a8cc-dc9a02146d5f", "value": "T157646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300027, "uuid": "163580a9-ee5c-4afe-98fc-a12f016cfd47", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300027, "uuid": "9277fdd2-d423-45f9-a040-99ed535c65e5", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9U:h1iw7gryNkSV1hy1Z1u2JLu9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300027, "uuid": "2a0063f9-c787-49f5-8a8b-5c8905a12d07", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300027, "uuid": "18dbcd54-3b6d-431e-ad81-2f4d9611c708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300027, "uuid": "95d29d90-43aa-4fe7-8107-2eb347f6999b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9643d7b1-5d66-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780283061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283061, "uuid": "dc4758fb-2137-4dd6-9488-2d79f31dea50", "comment": "Malware payload (Vidar)", "value": "6173a28853c674465a72f18cb0b36e68", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283061, "uuid": "411f6944-89f3-4d78-98e0-f1499a6829ff", "comment": "Malware payload (Vidar)", "value": "34b70412bd031251974f51be37e27e9cd1b1b6205f25ce6bf99707d04778af05", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283061, "uuid": "acffb625-b679-4677-a703-78fc4f0a7911", "comment": "Malware payload (Vidar)", "value": "b4a453d953809d6a5889457739b64654806693bb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283061, "uuid": "cca5fc7d-df64-4829-8f7e-bc56d956bef8", "comment": "Malware payload (Vidar)", "value": "766eeb4b10e59a48efaf67b588fdc986814a62c8ac585c462035a44d8f85677c48752f228a1c7580fcc62ea3deffae97", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283061, "uuid": "41eee257-6c40-4b1c-b3c2-7fc445e4f863", "value": "T13BD54787A862F5E1C814B2F7686341797B68BC213B7167FB299C29352F312C448F6F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283061, "uuid": "58bdf40f-8e87-460a-a820-2a7314de0834", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283061, "uuid": "be061eb3-c48a-4789-99e4-ee7ae03612df", "value": "49152:kuf4uznsRdylvsQxynZvKvVtVarGpPIyaqfb:knkm4i5ZvKvbV/Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283061, "uuid": "10245290-00a3-4663-9dab-ae773054f883", "value": 2887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283061, "uuid": "10e3d58b-a9fe-436b-a8d9-cfe958dd50ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283061, "uuid": "f825c2c1-160b-4d18-9573-09a6f0506a8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cab590-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293722, "uuid": "3c8626c4-0b7d-4e56-99fd-4fa5919b7033", "comment": "Malware payload (Mirai)", "value": "a2059119762581a49433c1f9b2eb2d3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293722, "uuid": "1be699b0-0ad1-4448-9b33-385563d48a19", "comment": "Malware payload (Mirai)", "value": "34c0565468f4b8fd8099aa18deb28a2766c74bd9805c834030dd773982edc7f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293722, "uuid": "2fa1e659-e5a1-4f95-8bd8-07237672d182", "comment": "Malware payload (Mirai)", "value": "d7d499630a27f25f810baebc6b1fbc7f9acaf5b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293722, "uuid": "e4895b52-b1fa-40f9-a3de-d3e90df631d5", "comment": "Malware payload (Mirai)", "value": "fce9cfe40007fcecb28d4550cc1ba64d0b4734c57b23b82d98e98dcbba60d43137de193c2daa7e27cd7305b3c6ae69c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293722, "uuid": "7719381e-3c04-4175-b569-ec348096cc51", "value": "T14B934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293722, "uuid": "5ac8200b-cbce-458b-9fda-31e4e19eefc4", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINQS:XGptyz+VJzB7T9/bLUAx9e/SBJOQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293722, "uuid": "717a703f-6a3e-4027-99c5-c4a85c1b8f21", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293722, "uuid": "7f20a25f-684c-40c6-8831-a0e4e66a8fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293722, "uuid": "d8bfaf8b-03de-4b1e-a4f8-5f010d739b64", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1567c7-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "00b7360f-7d90-4fa7-98da-f656b0b42853", "comment": "Malware payload (Mirai)", "value": "615afb0a6806770e0e15652ad7fffdc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "2b841fcb-a570-4e2a-b58a-c772ff64e919", "comment": "Malware payload (Mirai)", "value": "35490e92117a13045b528fe05c3aa20c784657d1a674f3730ab23aae045516f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "ac4005d0-5082-41b6-9974-ff3bfd55e4bb", "comment": "Malware payload (Mirai)", "value": "53b6c5f3273e872b57905a0e695c0163b8d890b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "8fa73e59-0b23-4b2f-8c13-4c693bc05f41", "comment": "Malware payload (Mirai)", "value": "f1fc79c89db485d9011014198fad72243ceee8311df073d647238d2fe9ad2cbaad43969a63f16644e1d750a7411f514b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "e9e27834-2174-4a6a-a1cd-7ed166a010cb", "value": "T108F2F1A8A5DAE1A5E1B070F3A20293453B5382F050E27620825F43AFB1ED3276D35DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "278af783-588b-4207-b552-36f878a744fe", "value": "768:cBvQmrPqIUoVyY6lV8kJMOuVhjOR5po3YFrD/GTCZClys3UozH:cqmjqINViKmMnmVdGT7vzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292328, "uuid": "256e9015-92c3-4276-ab43-1dfc85d9a600", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292328, "uuid": "d145643b-dcbf-4216-9f74-b3a2de41e6bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "790e0caf-33c3-4955-82e7-cb864cfd7188", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e1fa97-5da8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780311375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "68baa466-6730-4fcf-b7d8-997f56c0e9db", "comment": "Malware payload (ValleyRAT)", "value": "04a299513f6509eec5f96f8df2ed0395", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "25933e27-82f5-4ea3-b4c9-ea700acd1552", "comment": "Malware payload (ValleyRAT)", "value": "35d37575d85e16cfbb406a3f45dbb81740e736fbb388363e984176a33d13f462", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "513f78c6-8e3e-4a83-ba76-13ca44745d8f", "comment": "Malware payload (ValleyRAT)", "value": "8f785a45b1d2ee88fca72988c870cf2fc450cbaa", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "23d1872f-9a57-4f8c-adb6-85c1137d335d", "comment": "Malware payload (ValleyRAT)", "value": "3acf68bbf361faee4d02032278ce2212503f1af86c8c4aafafe18eb02251c71ad29c24e9649460308a0a1510f83cd9a5", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "2e1058fd-138b-4e5b-8321-9657882fa981", "value": "T169F34A5BB3A530E9E173823DC9911A4AEB72783107229BDF0755827A1F232D19D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "771347a1-00bd-4270-97aa-71b51793b5d0", "value": "b084b7b1fa2b24953dfdcdfdeec26a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "43a98ece-2002-4b6d-b6c4-fded45a54d96", "value": "3072:CYTGJoqppgcgk2GANoSq53Tf78iaA8ocHoh:CPokpJiNohRDsAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311375, "uuid": "949d680e-4e6d-47bc-8549-062d5347fdb5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311375, "uuid": "029d4ca6-9f33-4c25-a7ad-d4ff7f102a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "5b34a342-940b-478b-9311-8821bf366c46", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b43de65-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274265, "uuid": "da2adc1a-492b-4cae-b33f-35ffed8da69b", "comment": "Malware payload (Mirai)", "value": "566399bd13ce017d7da352829c3ceaef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274265, "uuid": "9a9e038f-f24f-4284-830b-e349f4fec874", "comment": "Malware payload (Mirai)", "value": "37fed2a10dee77daf86de3994554dea50b016c9a0a05919e2768c4cf88a5da53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274265, "uuid": "a360c53e-13ad-49af-95ac-5cf6167f9c4c", "comment": "Malware payload (Mirai)", "value": "2dea81dcae64840d4df201536bc135cd963d640d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274265, "uuid": "84ac3dd2-d9cf-48ff-8818-dfa5a4a9b5dc", "comment": "Malware payload (Mirai)", "value": "5be09a5837e73fd9dcdda27fb05759bd6be238791b3b79db1e915a726abc324dc39e99f2a6edd3702921a7eca4f02f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274265, "uuid": "42492da2-5c7f-4571-bd88-f944b29f3b0c", "value": "T100F2F16201C3AA7597980630F71003EF37A4D6B8D0DE64D72458A934B74F25672FC6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274265, "uuid": "3d736e0c-d7d4-4ced-a384-5e0eb45726c1", "value": "768:9a8LMCvgRxIb1qSA4AK+5IVP7NpEEQnl8D0gbHs3UozJ:x/4Rf9vV5UP7NpIno6zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274265, "uuid": "a3176519-9a8e-4741-9b9f-b222f79964ab", "value": 34724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274265, "uuid": "2c488ca7-75c5-420a-9e04-2e723ee99d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274265, "uuid": "087e7d46-0168-477f-b998-11c469f5b49d", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdd191e-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274299, "uuid": "42982910-e5cf-4268-ab68-52295cee1a3e", "comment": "Malware payload (Mirai)", "value": "e4444e09edbf4b99ab45017017bd25f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274299, "uuid": "29645b93-4043-422e-86d5-1d4aa62732c9", "comment": "Malware payload (Mirai)", "value": "38cc51a4cc14624d07dba786aab7610ec8b3c8387882d2c0ca755a88d93b53e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274299, "uuid": "b0457bf5-0ee8-4e98-bf76-d0fdfb44d63d", "comment": "Malware payload (Mirai)", "value": "3ed321ca9cc45f4779df6c4c8b74a6be74f548c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274299, "uuid": "365ff8f4-dcda-46a5-a5f3-5253d247322c", "comment": "Malware payload (Mirai)", "value": "04bd3e6413b9edae2d14bc80a5aab6e0d70d94e632290946446db7a63293ce083df031221bcbbde21630701622060ba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274299, "uuid": "bb04ce1e-d9a0-41a4-9455-b8b1c9d6147b", "value": "T1DF437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C369D93BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274299, "uuid": "b837a93e-e1b9-4529-b471-344aa50f086c", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7izBDK+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2Wt4+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274299, "uuid": "f0e2cc1b-179e-4e01-a010-7c6b89f4afec", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274299, "uuid": "822ddf20-adfd-466e-894a-3e27e5cd85e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274299, "uuid": "9585fe56-8d50-438f-ad10-b17a39797acc", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2958bebc-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292327, "uuid": "74120361-1ca0-4485-b0a8-908979dfffa3", "comment": "Malware payload (Mirai)", "value": "f62320d91485ea2b6dbccdb6b92465e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292327, "uuid": "339bd133-cf48-456a-a3a8-3de14d642da6", "comment": "Malware payload (Mirai)", "value": "39256d0ebac42184c8c5c8d5bfc4999090e5a0f3bf8cbf3ed4c69465e34cc104", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292327, "uuid": "f98f91c1-4128-4e6a-9d58-62e07b3cb163", "comment": "Malware payload (Mirai)", "value": "af2dc8ce46b2d3ada72d8351790512c22db1e2f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292327, "uuid": "b269448e-2ff6-449f-ad38-f82a9785e080", "comment": "Malware payload (Mirai)", "value": "3c691a8726521380575038cd109740cbcbc06486b9e64c1a5d729a7125f44b16dc6da4d8133e3871f593de6ddbef5df7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292327, "uuid": "1c36bac8-9dd5-4de9-a932-e1895c33f2da", "value": "T12003E1BCA18104E9E8A5E0B9FB910F110C9D4F29C829D85A35C0EB47CE63AF0B5D6DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292327, "uuid": "9f7ceafc-8843-4ee6-ac4b-0c318d9978cc", "value": "768:TgIzUxnbpXtsdS3/SVV86gdBK8Av4PXMkYNPQ+pi3O5LunJgGlzDpbuR1JwK:TgIzINddkVvgrKVPY+pi3IsVJuqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292327, "uuid": "a66f99b6-46e2-4e2a-91ae-529e3a5f8dae", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292327, "uuid": "7865e3db-499f-4a17-9e27-780187e43045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292327, "uuid": "b780b355-4804-40aa-b0f4-03daacdabd67", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d98641-5da8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780311375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "cdfc9f17-7c55-40c1-b8a8-94ba5e709727", "comment": "Malware payload (ValleyRAT)", "value": "7e7966f454b3558a1ec0f8e33d6f205f", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "82e5b93a-5341-4aeb-a008-fc6007bf06b4", "comment": "Malware payload (ValleyRAT)", "value": "395cad56cd4a16bb695ee014321f5828ec9147a0b605da26b87950afcb5aee6b", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "6568828c-5596-442c-982b-e23498c3790a", "comment": "Malware payload (ValleyRAT)", "value": "d1b41c065c4179c8347ac700a6e53a70ad07af25", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311375, "uuid": "ba41ae3c-2d5e-48a6-b7e5-4bcf80c41ef1", "comment": "Malware payload (ValleyRAT)", "value": "31b3c83d07235f72e9181f6866b289d21fa4c4a79860f966c1fa935b258aed167812ed8e10a40211f4a328b2c759eda3", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "0d1574aa-9c7f-4987-8372-938dccda9b5a", "value": "T179F34A5BB3A530E9E173823DC9911A4AEB72783107229BDF0765427A1F232D19D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "2b049fb8-4221-4e41-8798-8095b0709811", "value": "b084b7b1fa2b24953dfdcdfdeec26a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "2aad867b-8f5c-4b00-9186-b7e671a38935", "value": "3072:4YT251UpJgMlk2GAX1KC9Lc8CLA8ocvoh:4P1iJ8iEcIAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311375, "uuid": "0be43a65-b123-4584-8011-9f4efaf672bc", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311375, "uuid": "088027cd-a3c8-41d6-9699-fdb961ee8d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311375, "uuid": "632dbf5c-e67e-49d9-a5fb-3a262861c83b", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03b5b35-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780293520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293520, "uuid": "03a8063d-f6e6-4efc-94a0-0221eb8e7ef0", "comment": "Malware payload", "value": "a75df3e3dfb0c7c5a304355a3ecf3a6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293520, "uuid": "732566ac-387c-4b2d-9a87-2401fde9265a", "comment": "Malware payload", "value": "39e8de252a9b49609b07bc588c5a2957f7950d54a045705f6a1360102cbea9e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293520, "uuid": "92026710-2335-4225-ba79-3cec022eb1c6", "comment": "Malware payload", "value": "0db21f4fd8358b729ea40e145775c74b107cd1f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293520, "uuid": "529c1023-9d8e-4366-9e69-f9053af1a18d", "comment": "Malware payload", "value": "4909e2fe9ffbecf3c589a73330982967b903533197826a17c22446e2e9e5a29584fe0627868c5a17b80636c74ddfa8dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293520, "uuid": "a3d27dab-a017-470e-8b78-f8ff56795121", "value": "T174762A97B8D24952C4E43637B8BE81C432630EBA8BC7165B6D15EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293520, "uuid": "6b38ca88-4e07-4628-9197-f66711ec4871", "value": "49152:y2FVJ8GabZTzq54aNVd9yjxj5Gea0+qrc5BxqSVP4GFsbmyWkdu75Eh:5KZTzqCazd9yjxj5G14GFsKVtEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293520, "uuid": "a3428b6f-bb89-464e-9961-0595b80af5ab", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293520, "uuid": "49deceaa-d7cd-459c-991d-809450dcdc3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293520, "uuid": "18e15db6-3035-43d1-9bb1-60b1b669942c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe1e22a-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323557, "uuid": "42605e22-d8ea-4763-a62a-3ea7b14603a8", "comment": "Malware payload (Mirai)", "value": "74939a578a1bf1293241ac9c075189b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323557, "uuid": "d317fb82-441e-475f-8237-7a10551ec3d6", "comment": "Malware payload (Mirai)", "value": "3a83e4587d2793fb2b3da5b9e19b77bd4a7b82a223cc84861a7131296fe06e6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323557, "uuid": "15270c3d-1671-41b4-85f5-3e9bb4dbbb59", "comment": "Malware payload (Mirai)", "value": "953f9f8573bd89bb0e2859e19b7763a540729f5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323557, "uuid": "1a0ea35d-2d8c-48d6-9b19-dfda71c733b3", "comment": "Malware payload (Mirai)", "value": "110a1b5af5df910a9091b99b42c56047eaae2e1316c41a105cf83494b555a9a0adfac7d60044d7fe798aaf0270a96f78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323557, "uuid": "8b498c1e-f833-4436-812b-4b6662ae25b9", "value": "T17C264A65BC5EE553EAC863707B7582D0323EBC889F42D3236610FBAE59F675C8E12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323557, "uuid": "8ddebf84-7fdc-4023-a26a-c769c451e9d8", "value": "49152:7h4/Azu/tx36e5NUIa5E/Ao7BdCJLdXeiZzB1E:l4/Qu/tx36e5NLwEsJLdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323557, "uuid": "a96e60a8-c1cc-49c7-bbe9-a728c51b74b4", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323557, "uuid": "7c4ec13a-2ca9-4b8b-aec4-26506d069011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323557, "uuid": "e9ce853d-7030-4919-83f7-cbf4f7f2a213", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2075293-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "deb90408-a823-4b99-86d4-b92dbd55161e", "comment": "Malware payload (Mirai)", "value": "1fc59cbcbb00af11029bd1da3706b75c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "828adf90-4aa7-449a-8d6e-31fbb46129f8", "comment": "Malware payload (Mirai)", "value": "3ad9c39258d28df6f33718a5c945f845d4b32bb419cf23f2c68d91ac00dd872f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "ded8df9d-69ce-46d5-a19f-b97f840fc593", "comment": "Malware payload (Mirai)", "value": "3e4a842cfffb4abd123082801dd9f5abdf56f203", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "126dbbe0-ec58-4004-974c-b1c4e7d0b4ec", "comment": "Malware payload (Mirai)", "value": "3cb790eb43b293ac64d30b50e3439e00d2d9c3e8175f4a71129bf29efae09f132398119e483bb77d03f2288ba118d510", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "434cdeac-8f40-4ea6-a2b7-5b94437e379a", "value": "T14C83AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "e4cb4d2f-0840-4c5f-b9d0-696ec12e54e7", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7i:UeAsdukuhoNJVwbmuUqjLjwWii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292181, "uuid": "90287acf-b99a-4464-b2d7-3276132ad56e", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292181, "uuid": "9d803cbd-9b79-494f-8ad1-06801ab7073b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "de0b70fe-c02f-4669-94d7-ae9bb297b60c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf99a9b-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1780346800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346800, "uuid": "9eaba136-578c-4963-8e83-d3ba100fa644", "comment": "Malware payload (LeetHozer)", "value": "f4516bc6c7fbc6aabb769b2846121bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346800, "uuid": "d50636c1-8545-4a42-9358-475183667b0a", "comment": "Malware payload (LeetHozer)", "value": "3ba049daa21313c885a31654c9b0c94e9fe92323b202063b17f160c002b727aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346800, "uuid": "98f3c401-fd01-4e57-b909-f21bb5c20cad", "comment": "Malware payload (LeetHozer)", "value": "96d30d66b1a12b0c598c7fbc268bbb584443c648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346800, "uuid": "e9ad8fd8-11b6-4164-a641-524bd21364e6", "comment": "Malware payload (LeetHozer)", "value": "f3284c5d5b40b7abca6cd4c89546f6f0f052d312699c906c6df47006699d28f623de15dbb56c63cf35897e40f031fa43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346800, "uuid": "5f2a0628-c7b4-454b-84b6-6c24bbeb2a99", "value": "T14DB31A45FD509B13C6C625BBFB4E428D7B2A1758D3EE320399256F61379B89B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346800, "uuid": "756acd5b-cb02-4398-a53d-a75e90dd78b8", "value": "1536:cha2/lqrXlA3vjRsioRzmUcpzfTw19qRhZ0qhR4Xl+Ewywaqa/FK+ejss/8CTFOY:chaxXlejERzm5E1ciqTAO5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346800, "uuid": "adc95eec-cf98-4707-9d40-5d976af734e4", "value": 109092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346800, "uuid": "10f8db5a-19be-4df8-af60-54aefb8c0412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346800, "uuid": "9a452862-5823-4265-96cf-6e268278a63f", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4863794-5d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780283622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283622, "uuid": "7ca6d41e-4db4-4763-a786-fa790e0a88a0", "comment": "Malware payload (Mirai)", "value": "cbac744f82f15524ed7b341cfa306011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283622, "uuid": "262b1612-21fb-4e49-900e-a0a270a5fb9f", "comment": "Malware payload (Mirai)", "value": "3cf13f6915e916344708b364af4458befb09731bd920a637a3adfec34b6ea219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283622, "uuid": "611ae101-89bb-43c7-bb81-0570122a42b4", "comment": "Malware payload (Mirai)", "value": "f10e48ffe527d76ab943e534af53aec6867d485e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283622, "uuid": "dec796fd-fe2a-46bc-b442-3997f62bc397", "comment": "Malware payload (Mirai)", "value": "d90d69afdce2f573ab215a708f69d667944c083583d076c6a0b32860151ad9296f82d8c13d69d899742e31c9b958efe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283622, "uuid": "6f24585f-8611-42d4-8d9f-377ff66db076", "value": "T11114B50E6E25CF3DF369C73857B78B30935823D626E1D655E16CE2112E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283622, "uuid": "de197b10-bc09-4f4c-9062-6725b102426b", "value": "6144:1wDj4w7yB/xADe1yOczhFfrWqyFh4V6iwvR:1/w7jDC6lSqyFmwvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283622, "uuid": "1f89d427-3d77-4a7b-8725-458702f6f229", "value": 205960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283622, "uuid": "d7189c2d-46d5-42a2-972e-7a96d5d58e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283622, "uuid": "70add960-bf28-44df-94fa-762cf034ed31", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f777188c-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312430, "uuid": "b611978b-9a29-4488-aae6-c427540677f5", "comment": "Malware payload (Mirai)", "value": "819982fe5e394fde0f11310d21272368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312430, "uuid": "05f1c7ea-91d7-4d7c-8529-1cf7f5d08ae6", "comment": "Malware payload (Mirai)", "value": "3e7c0f7f5a57718c6bd0fc670dc0e1bb23445c83514192d5d5cf8d5e3c6d1bab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312430, "uuid": "e33b668a-b4ef-42ac-b9d7-55474f3ba7d9", "comment": "Malware payload (Mirai)", "value": "c23560446dac135dd3e880af09dc94ee652d2511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312430, "uuid": "492e3ef1-7a55-4ec7-825c-37a895a098c4", "comment": "Malware payload (Mirai)", "value": "8ed2677df7b86eec812943cfb124c3580ddd63dd952c16c88a07e80959a83d859a655bbd495c72d79398ec720222d974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312430, "uuid": "6593e831-3f82-475f-b9e7-ef07cd192b28", "value": "T10BB3C91E6E219FBDF7A9823047F74E25A75833C627E1D545E1ACD2102F6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312430, "uuid": "635a7481-c8b1-4dcf-a9cc-a2b3f53863de", "value": "1536:LaMgKh1hh5WOGgI7qX6vXx3RlKrFZMB8UhXgswi9rcUe2hb7Arii+:vlh8O0KroB8UhX19rcmMrii+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312430, "uuid": "ed6cf778-1e8e-4c8e-ba5b-72b14dddb4ca", "value": 118176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312430, "uuid": "43aa7a0c-7604-43c8-888d-7c73ab2dea6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312430, "uuid": "1566e5ef-59f6-4e1c-9306-4694d4221e0e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51095f5d-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277791, "uuid": "3f449d6f-0014-40c3-82c7-fd8b5bb77b46", "comment": "Malware payload", "value": "1494ec031b6103c6528f651ae7ace201", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277791, "uuid": "180d5178-afef-4d2c-b7b4-bcf33094e047", "comment": "Malware payload", "value": "40d86399f13d23ac77ec6b90200272391f8bb0fef00d896e27fa443dcaaf53e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277791, "uuid": "1d4f2ebb-d27a-4441-a76e-50966716e5a2", "comment": "Malware payload", "value": "567299267c67fd074569ad496f67426e8e1115ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277791, "uuid": "17ba176e-d171-4e5d-b455-2b202cdd2ce7", "comment": "Malware payload", "value": "15002f00b4d5dd89cdcfd4450a64fbc049089a35483b4f44009b9b645d2beecfc7797fc2ae3b4a8c19c2bd7ed4051b08", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277791, "uuid": "4ffce711-00ba-495e-a5b4-ba74d3a4e5e2", "value": "T166921A1937E89B32DAB64BBCE5A5D12412318F82A003DF192CEC31DE49D5F8642217BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277791, "uuid": "8ab05bf5-5896-44b3-b97e-cb3dfa36edaa", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277791, "uuid": "4ea3fac7-b7b4-4f0b-b1d8-7a0b570162d4", "value": "192:+yjWjNatEAa5PmYP/Yv1aE2xemUqYTaGmyv66cqjcRxuUEpHBo0IEKU5qE0YHETx:PahYv8E2xezsyBccUEZ+3G09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277791, "uuid": "775320ae-7c6b-49a8-88be-8d3e4d659fa6", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277791, "uuid": "816f7973-465b-499a-bacd-8dd5a63457b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277791, "uuid": "05fc2179-3819-4db7-8601-f63013750ee3", "value": "40d86399f13d23ac77ec6b90200272391f8bb0fef00d896e27fa443dcaaf53e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5392539-5df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780345927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780345927, "uuid": "22b7b0a2-0732-403b-8a69-bf42a28f33fa", "comment": "Malware payload", "value": "b474346f0d068f4dd2606e909e0ba178", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780345927, "uuid": "45ab5289-a7d9-4f1a-b13a-26c675e02caf", "comment": "Malware payload", "value": "412340eacacc4daa61c038e779175b0cb33fbe36d26f5532005afeac7e56f9c3", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780345927, "uuid": "b3d63687-0488-48b5-a93d-f320b3ce5877", "comment": "Malware payload", "value": "5a00dfed4b5c07434df37eb58ba651e8103a572c", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780345927, "uuid": "1954f946-7490-4ba9-809f-542408d472d5", "comment": "Malware payload", "value": "c9dff1bb2437eb5cba9621c56e073c8b6de46d104e6a4832bcf27a5c6a05ccf979d0b8cde7065296888a68345cccabca", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780345927, "uuid": "cab89799-fd98-4444-b876-ff5e7e48f2cc", "value": "T11AF63323A78BC233DF620AF7C5B4533915357A34173888CBB3A42D7DE4A26D16A76346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780345927, "uuid": "4f33bf12-de9e-49b9-81e9-903eba55997d", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780345927, "uuid": "326ad424-8808-4f67-8db3-df24f491d150", "value": "393216:FnLhEBvhMQz3dZ9vINxmI/ID3No88iZuNNviE:FnLhEB6QzNZYxLCe88iZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780345927, "uuid": "338cd680-ab0e-4f10-b684-089547cd1dd2", "value": 16696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780345927, "uuid": "07a4dd57-2260-457a-bbca-680d00cc4cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780345927, "uuid": "06617f2c-5237-4851-ae53-0cf9d39ee2b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa65830d-5dc9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780325615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325615, "uuid": "6a192dff-8f67-4198-bb7f-68993071afdc", "comment": "Malware payload (GuLoader)", "value": "14e08d4e2cdde4ac201a13042fde0dc6", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325615, "uuid": "75736adc-3f28-455b-a632-8f4110a5a1c8", "comment": "Malware payload (GuLoader)", "value": "415b8d60abff32d672f54987b15bffcf38cb08e0cfa9e218dfff3569e0cbd30d", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325615, "uuid": "4bfc6ecf-9ac6-4cf5-b6d9-c28c64bb852a", "comment": "Malware payload (GuLoader)", "value": "7b6982077f9c57e280d77102aba57ea57bd08689", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325615, "uuid": "5c4a25a6-929f-43e9-bb1a-4cc7342719a5", "comment": "Malware payload (GuLoader)", "value": "14e208d2f85873fb9996e76a1d2dfc9bcba5ee7b8b56f27f6be0df98b57e18933b033520c097e1d4858fa2ee1256a177", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325615, "uuid": "280577c0-12f3-4bd0-bdde-637eb2e57651", "value": "T115E312456984E4B0FCF8CF21EDAD755DAE6B3685200D880E476873A8CDE9BA1C1247D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325615, "uuid": "3ff34002-9f54-4feb-b197-d5413e17f48f", "value": "3072:MBOcTmL7FzLeAd5ZymPVbXDu7l5eughzWOrmVsdd:FcixeaymNjq7jeuJOresdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780325615, "uuid": "87b5dfbc-dd64-456f-a7fc-87ea6b15da7e", "value": 156770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780325615, "uuid": "8deca1a5-b794-4154-a3a7-5ac9231e3c67", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325615, "uuid": "6a72ab00-366a-46b9-8db7-c3d8d8e9939f", "value": "IMG - stampa il campione di pagamento di 2 pagine in 1 A4(1).tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3836cef2-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274313, "uuid": "a001378e-cfd0-4388-8bb5-0d5d6eb49834", "comment": "Malware payload (Mirai)", "value": "08a032b3406045c94b774b17bbb1b4a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274313, "uuid": "edd2695a-07f6-4c34-add0-25fe123e228b", "comment": "Malware payload (Mirai)", "value": "4349633d3b3f6d10fcedd93229d8480f8760f2de4b562d30dfd89367b89a3cd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274313, "uuid": "ee31d429-d3a6-4840-aea8-5a9c89c84891", "comment": "Malware payload (Mirai)", "value": "780c6a4769137084245ec5b863e5775583ad1db5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274313, "uuid": "84b77363-6d16-46f0-8a92-2c5958a5aa80", "comment": "Malware payload (Mirai)", "value": "2e69ff4c2e0d959c6348bea5961cd6a7618f33292002c127ad5200750ae6e992c665b5210ad07770cba2445125d5b8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274313, "uuid": "3563e659-e7da-428f-a948-39d8b498a283", "value": "T13B633A81BD815713C6D112BBFB6E418E372613A8E3EE32039D266F21378786B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274313, "uuid": "658dcc50-7c85-4a81-9ccb-78a8db4c78c7", "value": "1536:nv5bxamD209LfsLoam/gd78IOPYqqDIxRepMLvzo:v5blD5/g1J0hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274313, "uuid": "39ae71d5-4ff1-4815-bff9-9eb50c957c40", "value": 73364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274313, "uuid": "40a3553d-469d-4c08-bcdf-38c4095eedaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274313, "uuid": "0bb97128-d391-4529-b837-9edad4c46c01", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a91c94-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346899, "uuid": "953e6cf1-5879-4d4c-bfa8-944f1e29b67c", "comment": "Malware payload", "value": "e96920bcd8d2bedb36b932f663a64282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346899, "uuid": "1e00df12-8746-41b6-95a2-68591a62e25d", "comment": "Malware payload", "value": "454508178b3ed7d3e7fbf85a55877b3083accccc22696099710c787f6adf2ac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346899, "uuid": "d6280f51-07dc-4af6-868d-a6b96656bc69", "comment": "Malware payload", "value": "055c6636eb6b756b2c166095166ecd14aa016e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346899, "uuid": "867b243a-6812-4ab9-ad01-e1683e772b06", "comment": "Malware payload", "value": "11f5f183d02a5c8f2c8d707ededda252980ff39772c5bf503c167bbd2705adc390f1dcb3513a74a1889902eeedc51adc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346899, "uuid": "e81b408f-a035-4f49-b91f-de118587ff84", "value": "T13AC32A1774C190FDC8EAC6B84FEBE536E933B4291138B61E27C8BA261F49E205F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346899, "uuid": "7a4331ba-61cd-4e8b-8122-b6c9743d34a1", "value": "1536:IVovZXhDaeV9EN0xRZ9+dFjF9+xpJxivVYM7rsFEL3/upU:+I1hDRNR7OjF9+xxivVYG4Ejmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346899, "uuid": "48e41ff0-0ee4-48b4-83b3-0c0fd7101c77", "value": 121048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346899, "uuid": "92cb1529-8cc8-4e6f-84c5-733e1dd100a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346899, "uuid": "e4016710-d202-4dc7-877c-7c33ad140f76", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b06fec-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780312231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312231, "uuid": "1e3a8e8a-308a-4aa7-abf2-5ea78a5bd52e", "comment": "Malware payload", "value": "d8105a64db3455ab30148bfc1dd0ca7b", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312231, "uuid": "6e500668-2942-4f76-9ff0-2c42df3cb3af", "comment": "Malware payload", "value": "45c5f1a7782b2ffa99a3f8f3479a2b182de3e45d9297454190f41f4480494dbf", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312231, "uuid": "be6c0059-f926-4d40-b9c6-507e702b6713", "comment": "Malware payload", "value": "23f94bc8d2be993c62355b19d49810e4edf2c505", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312231, "uuid": "535e197e-6525-4b24-a928-d0d54c0829d3", "comment": "Malware payload", "value": "ab82feb0611bf8b6aaa1c670492b86ba16472952c0e0546b0fbc8de9df270a3f98c7c4bfdb89c1cede32483dbe4ae431", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312231, "uuid": "15e2b905-3cd3-453d-a680-dd94608858bb", "value": "T1E23412503E15A50995F89DCEE213F827D82F13CF776431B098A2A5B36FC97E1BE56110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312231, "uuid": "2e658ee4-9646-4d74-b883-3ddf61b41652", "value": "6144:UQXy6QkOBpxBYKxKDoZN+FaKJxV+ho8s7TfwwjJJV3:PgZCKKUv+QgxVj8s7T4wx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312231, "uuid": "71d37a40-8d8e-4d71-ade5-2eaad4f002c1", "value": 252992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312231, "uuid": "3dbe1eb6-e336-47ac-b488-f1bf60ba7837", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312231, "uuid": "bb5162c7-abda-4c0b-a4cb-cf8ef6432521", "value": "WpMuqhqBHlougRxdQYMvuCgbw188.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f15079-5da9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780311949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311949, "uuid": "b70f09a7-e25b-4a11-8dd0-8ba228e10525", "comment": "Malware payload (GuLoader)", "value": "3f39fa0d3feef07c6ef5c45b881efee8", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311949, "uuid": "07be48b1-1215-4724-981d-8909db3236d7", "comment": "Malware payload (GuLoader)", "value": "4601f3f8d9a8838bf0dce145fa346687c106c10ec82e6529f80a02771dada659", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311949, "uuid": "e9072d95-d3c1-4afb-acdb-8eecdf0d9375", "comment": "Malware payload (GuLoader)", "value": "2f8d3aed1cffa7a9d79e61a504dfa29362457bc9", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311949, "uuid": "7084f807-dbba-4341-80d7-fd0d0757323a", "comment": "Malware payload (GuLoader)", "value": "820452162b401be287118796526db405d022b4e584a0f7742b340ed504534d90c6e6ed0f085244dc7a23a89bafe53db2", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311949, "uuid": "0499f8d7-20fe-4c7c-a49e-59e6debd2c62", "value": "T120646C20ED24067A0F47279DFDA60B71CABDC609862754F1F6DA070E60065ECE3BE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311949, "uuid": "d3ad31ce-ad80-4e2f-bf2b-ed5ced220ad6", "value": "6144:QSteILMxWLtPAlxbRReoi6FNoMo6+taX0yU37mlynHesWx7P2RTGKZ2e6V:XLMxk5mTeoE5y2y7ORTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311949, "uuid": "794c21a6-ca50-4bc0-9e60-88ba03dcd74a", "value": 324674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311949, "uuid": "e91550b5-593a-4e55-b623-2bfdadcd8ee3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311949, "uuid": "755e0705-2f71-4ff2-b1b8-b1e8ab323bce", "value": "20260601-001173.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193442a2-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "dfb229ad-0309-44ce-9ae7-d0bdb154707d", "comment": "Malware payload (ConnectWise)", "value": "77689b4f2f1216bc713809cc8bceb0ea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "3cf64821-449d-4cda-b105-42c76fc957fd", "comment": "Malware payload (ConnectWise)", "value": "465d1febf4a78289be81fe2b0c2c792d4a9f487279c9001c471934d6b37defec", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "3731b166-383d-47f4-b1fd-3c1e453ad1c1", "comment": "Malware payload (ConnectWise)", "value": "89e7157994c32451ce54221120c9111c05fc5c06", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "e32adaaa-1e37-469e-86c9-2dc9873546cd", "comment": "Malware payload (ConnectWise)", "value": "88c0da2313985a6e7271e63d490d4fa86a8fe5602bb1fc25c25be3a398a25f44351c97015a15cce9e6ee6bc33031e7df", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "b3d067dd-194d-42a2-8be6-4ba6ed8a188c", "value": "T1C446E101B3D695B6D1BF1638D87A56696734BC048312CBBF5794BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "89c55f46-11e9-46e6-80b6-e6221c873ede", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "1e8e2430-0cd7-4e35-a3bc-1a3c193b87a1", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300031, "uuid": "3d5f986e-c4fb-4f80-b2a5-c2c72eb81999", "value": 5651784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300031, "uuid": "cbb4177b-7f7b-49a9-bb7d-fd4f9e1e1486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "a581683f-ce0b-4813-b599-fcba8b19d18e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b880a8-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780294276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294276, "uuid": "785ae8df-a0ad-4227-b668-785826df28c2", "comment": "Malware payload (ConnectWise)", "value": "5b09bbc6974a1358ab5ca4552fcfebec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294276, "uuid": "0097de7d-0484-4784-87e2-cabb37a80cd2", "comment": "Malware payload (ConnectWise)", "value": "466993d4226ead8a555781710363a86534f42b985d1441eb30b324380c25d319", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294276, "uuid": "03ac8ae4-f7e5-4ea1-abf0-b1b252ca2030", "comment": "Malware payload (ConnectWise)", "value": "c4fc40219c577ca7a3085b1593cd182104a396d2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294276, "uuid": "93f31903-3d17-4d13-a466-6684673088e6", "comment": "Malware payload (ConnectWise)", "value": "5566655b2169e5bb9b68a67cb466a94a74716cb96f3889d7efcce0d79a5f801a00a85a2b03fe28546410caf0e8f5e6fd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294276, "uuid": "171b9cba-4ba1-4de3-867d-84c1082349c6", "value": "T1DF46F111B3DA95B9D47F053CD87A82A99A74BC048712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294276, "uuid": "584dfa31-006d-4db9-9650-2c9c9786ccdb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294276, "uuid": "f908cc6e-d50b-4051-a268-fccc38ba53be", "value": "49152:+EEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM3:rEs6efPNwJ4t1h0cG5FGJRPxow8O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780294276, "uuid": "a1f30afb-6867-44e3-830c-9394ba6695e5", "value": 5846128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780294276, "uuid": "0102e032-7c94-414b-9e7a-99882b1847d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294276, "uuid": "7b62c68f-b5e6-4953-9d44-07f8c84b9145", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d4d3e3-5d6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780286068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286068, "uuid": "27b70bb7-ee03-46ee-bdab-45028b211f14", "comment": "Malware payload (Prometei)", "value": "4b4e06daa1cfc1ebcf83b6719e39e45d", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286068, "uuid": "94a7a83a-16e4-4f1a-9ea2-9239ccd86f1a", "comment": "Malware payload (Prometei)", "value": "46fb80c2971474aab1614bc3fab8b9753098f280bdfb542484f86f50b05b4031", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286068, "uuid": "ef1a95ed-4761-427e-a5f9-9e64b2751ec7", "comment": "Malware payload (Prometei)", "value": "484a5e0c2b940f3660b41a0e9ae84363da7dec32", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286068, "uuid": "92c7eca1-dab7-438e-8d3b-04fc0f71058b", "comment": "Malware payload (Prometei)", "value": "57c71d5057e517b6aca881cba17e76832433728237213a0e4ee0b8772d85f81a198792d2a781cb914aacb4d33204e0a8", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286068, "uuid": "c33de4bc-70ae-43d7-88e2-fd9f94c50a2d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286068, "uuid": "a2904216-b686-4293-aa0b-b03dd4869aa8", "value": "3:B5oJBU:fEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780286068, "uuid": "b4cea8d0-492e-475d-a2ed-83619c097cb1", "value": 14, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780286068, "uuid": "d23751f3-a2e1-4126-a208-053dd80930b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286068, "uuid": "ce3fbe26-01d8-4bb2-827a-a9a1c6ecbdab", "value": "46fb80c2971474aab1614bc3fab8b9753098f280bdfb542484f86f50b05b4031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677a514c-5d9d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780306605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306605, "uuid": "e4fcdf0d-f526-4f86-9a2e-4c729a027731", "comment": "Malware payload (AgentTesla)", "value": "4d893813c460952fe38805c3e09ecb49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306605, "uuid": "1e89f79f-7c85-4dab-8e58-8faaa7b9ab2b", "comment": "Malware payload (AgentTesla)", "value": "478a38fdab62e21fd1ce46f170f19eb6e9b921e45ec307796a38695206a77bb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306605, "uuid": "00babbad-6b4f-4593-bf94-bdceed167c86", "comment": "Malware payload (AgentTesla)", "value": "124bc08b4b78f5ecf3adbd95d843408f9269956f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306605, "uuid": "21c90e4a-c585-40bc-985e-df4d53357a3e", "comment": "Malware payload (AgentTesla)", "value": "2176c601b97b328fbb615e17797880858e52dd2015b2b0ff13d16b1dc05d09a861a847a101af5ce15297aa9f4f233b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306605, "uuid": "807ff03d-b056-44a4-a7b4-755d4b9df6d0", "value": "T15946DA03A1655C268FDEC7EBFB1A65C56D0DEBF2340C9F2E102A4828D690D1A74D3EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306605, "uuid": "66375ff9-72d7-4081-bf7c-86c840b114fc", "value": "98304:7izhyQfR94nFKU9RMFDC/nnHaBD1nQVxpil893inrW/7bcNi7bsGt8ENTF:7+jjAFj9n3xpiYyr2wNS5fTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780306605, "uuid": "2cebcaac-8b4c-4394-800b-9e3008ffad42", "value": 5840705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780306605, "uuid": "b104eda2-3165-43b2-845f-0aecee97c1af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306605, "uuid": "5ba51c1a-b4fe-47de-8655-6dd8aa1eb1b5", "value": "DHL SHIPMENTS NOTIFICATION 39952312 ARRIVAL NOTICE DATED 06012026_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d183d6a4-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "9202937b-444a-403b-adff-5e169c6f7271", "comment": "Malware payload (Mirai)", "value": "b1ef9c2a944280c1a2ec04f2c1be3c70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "cda6af47-097c-46a8-afa1-fedbcda09cb9", "comment": "Malware payload (Mirai)", "value": "4842886c2ad6138c274704d82ebcfebdcbaf4e8ae49868eb8299180ac2bdec06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "411bad9d-9e1a-4d99-bbd8-ac94fa714019", "comment": "Malware payload (Mirai)", "value": "70df05ffdb9f58c6bfcba4eb93fc84e1f0a1cc52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "17e48e5f-1951-473b-b50b-06051dbf0ac5", "comment": "Malware payload (Mirai)", "value": "396c24d84170dbda91c5e485ec9582280408bf82bc55ab580e7c3a63a87971b3dd38c63931fec23e742c8ddf568d56f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "672b072b-d663-41bf-9b0d-f73bd6c34b27", "value": "T1EDC3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "e15f1445-0de7-42a8-b699-145a1b1c4422", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMfN:MwCvdHmezn0nUPMu9KryXsMfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292180, "uuid": "a3854475-7210-41d7-8863-89013ba70592", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292180, "uuid": "2bb97ea3-b5fe-427b-862a-aec192a3f1af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "8edb43ea-977a-43b2-830a-48619e8618c9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4db230e-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "98aab60b-25cd-4c5a-ab3e-39a6bf901658", "comment": "Malware payload (ConnectWise)", "value": "fdd1bebcc1f0d9bc496ebc7d896893d0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "2fac5940-0cd4-48ea-bf9d-3354c6ab2d9f", "comment": "Malware payload (ConnectWise)", "value": "48752c8ecb8ddbb0661bcde333109566836d8d0033ebfb9223e19b1a43748cde", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "b1cb2682-bcbb-4249-84fc-45adee94135d", "comment": "Malware payload (ConnectWise)", "value": "5974ba29b9b84fca2907b8d1e794dca2859ad2dc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "c1a52d01-6729-43af-93dd-3d247c618f1f", "comment": "Malware payload (ConnectWise)", "value": "c3b5c503e66fed402c2dadc3434103b619425144c66d36a2788a8672fb44c7e34b78ea6a69c5cafb6c82d61961d57c6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "823fe6ee-77bc-4386-a1ad-c2e8c988d857", "value": "T136647D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "57fd3916-9446-4de5-8f36-dd7fe7856807", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "e75712f3-f9b0-4bb4-b33a-b62f07844ac8", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297688, "uuid": "193a2a59-ec91-43a6-8e43-bcf2915fc648", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297688, "uuid": "76a5908e-a742-41b9-a1b1-d442bba976bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "9da8ad0c-8996-40bd-b0a2-28d8b05cb9fc", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faba824-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346857, "uuid": "20599292-1a27-42e7-81ed-979caa3c2db9", "comment": "Malware payload", "value": "516f0cff011703b6ade9f168e6150b74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346857, "uuid": "3caad841-a47f-4430-9b57-8e12e56fc000", "comment": "Malware payload", "value": "48a6cfdf658d7bad4938c7da88430d53a82564b86411f00e5ad8cc7977b04638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346857, "uuid": "456c632d-af89-4c96-a7bb-486bc57cd796", "comment": "Malware payload", "value": "af992624cbb542c69ca369a776971ed3dae1fb5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346857, "uuid": "916ceeff-a734-4f90-bc71-063e032f9418", "comment": "Malware payload", "value": "d0edc9c215873c415683a0db3ed7a86c44d7992ca1127f9b24d3b2759697d8a7358e9ca6705c01473ddf83ccec38e781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346857, "uuid": "91afd048-7d42-4ad9-95a3-cb1d0630a630", "value": "T11582F81BA6F76D0BC1C0A73501E31316F6A9AF994018AB4F7E191C5F6F983102C5B79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346857, "uuid": "9dc91f03-2151-4c2f-ac0b-54c9064c5153", "value": "192:FEkTlVRg9Gjsa0Ha/9Q0MiPYGFj3czDx3Uzmcf2If73YeS22EwzRw0Xx1ykaYzeV:FEkjjsRirMe113gyaADIQ2DNPXx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346857, "uuid": "79e834ce-186b-481e-9d2f-fa2deaec15ad", "value": 18380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346857, "uuid": "1bfb2fbd-810f-4f75-86ef-3afa1fa1146d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346857, "uuid": "6cec1cd9-9af5-4810-b970-c61c6bb918fa", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f5ee7d-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "5d570ab7-2eea-410e-88b3-45d3b3e1995b", "comment": "Malware payload (Mirai)", "value": "1c3f26c03cc46cbe1c11ab95114c8258", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "6ca98441-c4de-4d2e-aefd-8c4b057b37c4", "comment": "Malware payload (Mirai)", "value": "493bac7ba0c33404c61c8fe3b30494e351b505f0ae82ed2adf7bcf7f301a6a3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "1be0ca17-324c-4659-ac23-3d94fa5584b3", "comment": "Malware payload (Mirai)", "value": "cf9dea34cb5b7b99f2c5fdbfa7245bd90456e6b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "fd2b3056-ef5c-4696-b15b-9574d6a7f259", "comment": "Malware payload (Mirai)", "value": "ccf4bac63c45808d23e5bb6d616d4ae4f1ee819f82140b1fed86b105830de53f2613bb9e5ec8847191870c1b06df4ad1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "bc4fc91c-e1a2-44b6-8bae-c8d66ba0902f", "value": "T141933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "3780cd3a-d41f-4800-bcce-d6b0b77e4707", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+L+R:KvjLrKGG4syfcIhXiuxpUN48L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293724, "uuid": "5f515fa9-4b73-43ce-b9b9-29f2f44442f4", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293724, "uuid": "71a76909-fcbf-422b-a49e-028e3a4a0fd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "9dedf8cb-fd05-4fba-92ac-9bdb5c00e722", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98ca7c9-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297696, "uuid": "6a803261-5119-4278-987c-d77d8638679b", "comment": "Malware payload (ConnectWise)", "value": "42e7bcba6eeece400e305d028b3cbebc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297696, "uuid": "390694d9-5277-48b5-831c-e08f9618794c", "comment": "Malware payload (ConnectWise)", "value": "494242e076faf0ff5e2d46f6676982101cb81d0265d05c1483faeb67e5620306", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297696, "uuid": "06489174-e6bc-4f77-8f4f-808c02138a51", "comment": "Malware payload (ConnectWise)", "value": "21eea31294e0fd4147b919295fd45f6fd94b9952", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297696, "uuid": "216df06d-823d-436a-a1f5-5357a8b70a88", "comment": "Malware payload (ConnectWise)", "value": "294dc32683b10eb697b593354abaa186180844b9e94013e814028948400a07a6c3f3286d4603131e1cd1d12db21e2400", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297696, "uuid": "fdbcbcb8-53e7-47b0-814b-6956aae78b2e", "value": "T19846E101B3D695B6D5BF1638D87A52A56634BC048312CBBF5394BD3D6E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297696, "uuid": "9d9dd06b-3523-443b-a397-4fce038c8915", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297696, "uuid": "ef71ef77-0285-4bc1-adda-c0fdf0103857", "value": "98304:YzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl/:YhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297696, "uuid": "c249a3cb-7863-4d75-ad54-c42d020c283e", "value": 5720656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297696, "uuid": "76d1e694-c6da-411b-9382-d116d3661eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297696, "uuid": "cff322cf-df0e-489b-b524-49853c18bc07", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2301047-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780323561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323561, "uuid": "a8853aa6-fc37-4ecc-b5a6-dd6f0152b6b7", "comment": "Malware payload", "value": "805ce85b56dfa16ffeb1152ca8dae1bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323561, "uuid": "b318c55a-d096-47a7-b711-3449229dfbec", "comment": "Malware payload", "value": "49879e3a35816bace5313e1a33fb4888a3c41676eab61e8a13e0d26370879b58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323561, "uuid": "32805836-7726-47db-b30d-a7ef08adb8cf", "comment": "Malware payload", "value": "91552f9ae9f70d23e75b49a4a464e5327475347a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323561, "uuid": "1ebdc871-4705-4681-a606-e0396009b8ec", "comment": "Malware payload", "value": "0f1b599ba1661b8801eb2b8b6dc3fee6aea838b2003c7d61a75f9cec56e1e3c6713394922941919d6bc495aa2c114c05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323561, "uuid": "6b44b0c1-432f-4641-9196-ac859cdb1334", "value": "T169262B47F85181A5C1AED130C666D293BA317C885B3023D32B61FBB92B76BD4AF79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323561, "uuid": "d9120b5a-5d28-4383-8bbb-d30f1d5cda72", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323561, "uuid": "b5ba29e4-d1c8-45ea-ae78-306ae6612784", "value": "49152:Ro5ffZrb/TwvO90dL3BmAFd4A64nsfJUti5H2Cbijo+AljjeKCf4a6iF6CR6L5Ev:RykCRb1g6dEaHx4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323561, "uuid": "81605d10-2ff6-42d5-b0eb-c37901a6d8b1", "value": 4645888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323561, "uuid": "0dba7dd5-38ed-4631-be78-178c65ce18a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323561, "uuid": "83213eea-050f-436c-b8db-31d389a63033", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e1292a-5d5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278579, "uuid": "0bced807-dfc1-46e2-b68b-195b52cf8885", "comment": "Malware payload (Mirai)", "value": "3ec6380d25a246b0c12d67a870a0b75e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278579, "uuid": "1553d011-ba89-4d9d-a91e-d4f31d3eba1a", "comment": "Malware payload (Mirai)", "value": "4a74e35e34cbdd680b6e99162913e3854121c3f4b94d1cf80bc93bdb7ef69532", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278579, "uuid": "37e05e62-e80c-4f16-8174-1e299c9e7fbf", "comment": "Malware payload (Mirai)", "value": "9060e38468f48c26b9513d100f7093c355ec2e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278579, "uuid": "03ad801d-f2d3-42bf-ad47-683a704dd50f", "comment": "Malware payload (Mirai)", "value": "b449f9119545a2e0142c85cbfc113b743b78ac6ccb5de19380625002c9e21d146ad7b55055c19c896a40aabc679822f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278579, "uuid": "6bed1034-8211-4143-a13d-7c59f6f3eac4", "value": "T1AE532994F9569F16C6C60573FF0E434D331A77ECE2EB3213EE1A6B15729A42E093A046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278579, "uuid": "7f7160a9-bfab-4cc8-9a2a-c896cad15d0f", "value": "1536:O8JI5wn8xDCzn6CU59VeCOzCp0HVIxWCFE0t61uP7:O8JI5FxDmnWhB6I01+RFE0tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278579, "uuid": "0ff3afec-597b-4673-8750-c39413f11829", "value": 63008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278579, "uuid": "cf9b70a4-6206-4d57-b469-a74ca6e2e3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278579, "uuid": "b7ce4922-1f96-4d97-bff2-3469a3bb6ff3", "value": "6qty", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2b0223-5e0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780355418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780355418, "uuid": "60e13a90-bac6-4fb3-a620-55c4b29b1e3f", "comment": "Malware payload", "value": "6696d103ff1ab29d0796a1664636ae79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780355418, "uuid": "ee096dad-c697-4221-a05e-e80cfcc02985", "comment": "Malware payload", "value": "4a98b2b72a5f6c9fa0d01b6ccf9a8ff7ccfc3a3f7117398888b0b7de40eddcb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780355418, "uuid": "1dd35eb9-70aa-4599-9208-a6eb4872e4dd", "comment": "Malware payload", "value": "0fc9879c57f9bb3571672d5b0b57df3d29785e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780355418, "uuid": "566ee273-9cb8-4eda-a766-f4b678f2d5ea", "comment": "Malware payload", "value": "821866463cf9c4f5e648ecdb858e8235f60a9f42896b4cfda525e2b7a0fc39b032136b6b4218090b84eeaa781eee4499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780355418, "uuid": "d9bd0eb9-c029-41a6-a660-13a019dd581f", "value": "T1F508336CCAF9529FEA7E5CFC21709933FA55742D9E28389B67E86021727300D063D987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780355418, "uuid": "dabc76ec-7601-41f2-b7df-2ab52f78f3a3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780355418, "uuid": "8b5c513b-e914-4a0b-b0cf-80f19cffb703", "value": "1572864:Gt9IKP2MReJbGWYLeTqowzKYypCPRfYLgRLlPBnU6InslAwkAG7:GUKOMReJZYpoyKYyuB/5PU6InsWAG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780355418, "uuid": "d4e3347a-1c31-4c8d-85ce-cd244a659208", "value": 77233053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780355418, "uuid": "378bc458-75ae-403a-b989-469d4c9d04f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780355418, "uuid": "c66b7163-f042-4ca5-949d-97c8a03ee3eb", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63988b3d-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346971, "uuid": "a9545464-0f04-46f0-b779-338762603297", "comment": "Malware payload", "value": "28aae6d95b342c1c5430da60f280ed77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346971, "uuid": "cf990570-c0d1-4956-a460-d518c859a78f", "comment": "Malware payload", "value": "4ac01c402b80fd4c26683df46c9b2a05e47662219064d102ba99643ed5010e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346971, "uuid": "d920039d-414a-4eba-b331-d5d027ab2684", "comment": "Malware payload", "value": "a4efe2815ef6edf4f6604f1a712db5515d771a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346971, "uuid": "d05659b5-582e-428d-af06-0282dc0dc6d7", "comment": "Malware payload", "value": "df142b445ae18614cf9debd0f26b516a84285c9cf02617f3a258d86b43a8b9c7c174a52b520d620c4c8f18b9bbaaca53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346971, "uuid": "a69d0df2-36c6-4e97-9adb-b2c33a198251", "value": "T108A349B3CC262E6CE669D9B4B0B08F791B93995581479FBE6573C2744043C8DFA063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346971, "uuid": "2ec0d644-814b-4402-968e-1b4f8b6cf978", "value": "1536:9xHDWWqT1CAKWqeR94MFwz7apWSf02GQOXA:vHDWWqZuWiMFSGpWS02LQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346971, "uuid": "0525331a-8278-401d-84e9-adbc7c932c9a", "value": 100964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346971, "uuid": "4b42228e-d7c7-4a42-ab36-c6306e54fb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346971, "uuid": "364ecdb4-ed95-4060-9f4b-e2e5079c810f", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816ae320-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297629, "uuid": "f470bb3e-e1c9-4ed4-ba4a-96f9a505640b", "comment": "Malware payload (ConnectWise)", "value": "d225595c75c238f4fb69691739fc8780", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297629, "uuid": "c4338db5-df24-429c-8463-1cef52af6199", "comment": "Malware payload (ConnectWise)", "value": "4b1dff7c15d82f76d1704871e63bcc8daabc85e685640c96bd8d9add7c57857c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297629, "uuid": "e1eb021d-5a47-48a6-a578-5e96738d0cc1", "comment": "Malware payload (ConnectWise)", "value": "e004928d2eade37099a25458d96edfe87daaa696", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297629, "uuid": "265eddc7-66d7-4339-a32f-ea939b6a6af0", "comment": "Malware payload (ConnectWise)", "value": "39f028d6df7bc3394ad1a36b38971f5a251bf137a38237cbff41a626c6954c04550965d9a8886b7e0562cc62f7674ebc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297629, "uuid": "e560ba47-2d30-4e69-9d46-2e8fbf4b06e9", "value": "T17846D001E3D19577E46B0538E87941675634BC26A311CEAB53D2B92F2F33FA04E32B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297629, "uuid": "680dbecf-0880-4d6d-a47e-631301799f05", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297629, "uuid": "3b129984-cc79-44f1-ac18-de23d3154eb8", "value": "98304:AzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:AhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297629, "uuid": "8fbf8453-11ef-4274-ad71-389a25968cdb", "value": 5760328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297629, "uuid": "4dd598a7-1c09-496c-bca3-c878661a76b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297629, "uuid": "2a07a944-545a-412e-890f-e5c56b193c01", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6338bf3b-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780316906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316906, "uuid": "73670009-6560-4e31-88ff-3650b2dab5d4", "comment": "Malware payload (AgentTesla)", "value": "96961b924e5c5406b608d98ac274096a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316906, "uuid": "cd3ddc0f-3e79-4766-86a0-6e2a21090468", "comment": "Malware payload (AgentTesla)", "value": "4b58c4206f46ec31b8aecb92586e485238bd1a43827ac83455718b801826b6a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316906, "uuid": "c5b3fa3d-a843-4634-bf5e-e6601bc8b647", "comment": "Malware payload (AgentTesla)", "value": "f86c4844dcbebb4bc9f5771d571f725bfc305fba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316906, "uuid": "f373d58c-f571-4943-b9d0-4ba74768dfce", "comment": "Malware payload (AgentTesla)", "value": "f2a58d941f04606d8bb345e7ace38af3b1e093fa34f90505de1a4d6443d434f86945c8cdc4ab3786da696c9af72a4f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316906, "uuid": "14bad36c-a3ba-4ab0-a5a9-675a04b7a1a1", "value": "T1D846E8436A97911B730E879E9972F9E1E80E1D27B4035507B06CDC28B3EFD9762A9133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316906, "uuid": "cc9b8623-5e89-47f7-8abd-f0ff97d20aaa", "value": "98304:xzTAgZzrJm2mc2HKc8oshVveDDcWdpVwaEpT8VmVfmpwWHvd9uprgOmzWNB+DmQu:xzTAgZzrJm2B2HKc8os3veDDcWdpVwam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316906, "uuid": "cb862284-fca2-478c-9c56-7c5042237c56", "value": 5843105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316906, "uuid": "1baa77cf-33c3-43dc-82eb-d443a41a70fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316906, "uuid": "a0a599eb-9171-41ae-a561-40eca5c02b20", "value": "USD 144,300.00.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6962fae2-5db8-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780318204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318204, "uuid": "6fbae707-ec0d-4c58-bd40-cae302c7c915", "comment": "Malware payload (NanoCore)", "value": "0b9b6792c1978e391c85694e8df8f343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318204, "uuid": "ca97f19c-afa2-4293-b315-95304c7649d5", "comment": "Malware payload (NanoCore)", "value": "4b99f3f7c3842ccad6430ac5a78c7b8a5373e2ad7859b354c9aa3988f1672103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318204, "uuid": "878c9bae-2902-4721-b442-7d315bd3ff3b", "comment": "Malware payload (NanoCore)", "value": "1de5b2e1c266e9db2b0eecb2f34b0e4e38a78c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318204, "uuid": "dba9f8d0-9ddb-4cb2-8b80-4f871750de27", "comment": "Malware payload (NanoCore)", "value": "4f598d4645456158e2c6e820d2bac83709315c19c689369aee60fd9380a0b79b129f9d066f5b3362e7b548348278ddd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318204, "uuid": "2b7b5ef7-cf83-4906-b038-b87057c728e0", "value": "T15914CF5677E9892FE2CE86BD612241539379C2E3D8C3F3DE28D415B69B263E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318204, "uuid": "0a9ba44b-0d80-4cff-8b17-c42d370334d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318204, "uuid": "10d9a677-6edd-4c76-ba12-8489287d9afd", "value": "6144:MLV6Bta6dtJmakIM5NUBPnGZd3wwMi5TYa:MLV6BtpmkOMOhwwMi1Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318204, "uuid": "e505335b-044b-43d1-9ef0-b969a56f6fb9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318204, "uuid": "ea3832d2-3d87-4a42-897b-3d3dd0f2bfab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318204, "uuid": "d4526006-bdc1-4a7a-bc66-c6612f878927", "value": "gem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ac238f-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780298651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298651, "uuid": "8e47fea1-0a4a-4f51-90e1-98448e402187", "comment": "Malware payload (Mirai)", "value": "18267eadcafe0113c403dae7f83c4f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298651, "uuid": "b8662ad4-4f49-437e-b0a6-fe0d871f0bb3", "comment": "Malware payload (Mirai)", "value": "4c8d12e5d810d705aa4b58e4ff1f5778a70b60bbd85486da1e75e422e67a282f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298651, "uuid": "1ea190b6-f36d-468e-97b9-167e5cba58d4", "comment": "Malware payload (Mirai)", "value": "b7ea691ebe40337d8eb61190f8d1f21641eae02c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298651, "uuid": "a5906d4f-84f0-4122-a03d-102e4b9bbd51", "comment": "Malware payload (Mirai)", "value": "bacaffc343aac0c58d86869503665ed855bd3997e739d4385985b13fed7725c24a1f1bb116b857b4156e788496ff2b5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298651, "uuid": "a7ed095a-ada1-4706-b22d-195db5982668", "value": "T142C3E706BF600EFBE86BCD3746B90B46258CA51622A83F757538D918FA4B50F16E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298651, "uuid": "e67b7973-ee94-4a1f-bd93-d46c497f781b", "value": "3072:msRXsgbl8tVa6DZhPejKD1MypIT1Vtthrs:p5beV/DZhPgW1MypI3ttW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298651, "uuid": "9860515e-d4eb-4126-a37d-f956351901da", "value": 124232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298651, "uuid": "c858b11a-21cb-42c8-921c-c0fe9ce583d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298651, "uuid": "926a14e4-56d8-4577-aa57-509adcd1b84c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b166ef-5db9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780318470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318470, "uuid": "43af8ee1-b035-496b-8adc-c143eaeec983", "comment": "Malware payload", "value": "bf81069e8c6cc056d35b219f9ff97fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318470, "uuid": "48db795f-4a78-427e-8a55-aff136599834", "comment": "Malware payload", "value": "4ee9a8315e21860df7958a8a7cc289ac2d30e7d9778ec245adeba576cac7e482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318470, "uuid": "c59e8b7b-ec7b-42d2-96e0-92c521f43e77", "comment": "Malware payload", "value": "6d8afcb82fd92dd473013990b9b833dba448fabe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318470, "uuid": "261238c3-77ab-401d-84f3-be55ff3afd41", "comment": "Malware payload", "value": "1733624391095c8355af260e7e52a28c2e744490ca2143e3f5b9508500c58bffa42e877c07873e4c36844b5b08b72974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318470, "uuid": "a627b627-391e-42c9-948b-90c2960fc563", "value": "T138262B07F89955EAC1BEE1348691A362BA713CA5833037E36FD0A67A1A35FD46D3D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318470, "uuid": "6a040f82-108c-4572-920f-bb992d1f2f8d", "value": "49152:c6DbB+PsdIAvcx/+5RCByR8EEjMG7CIuHOlsokIjn6DfV1:dDV+PsdILB2CByqEqMG7T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318470, "uuid": "4c47c594-5bcd-4a1b-b527-ad36ebfa9b37", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318470, "uuid": "940f9058-613d-493f-9f2d-e60fb698386c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318470, "uuid": "da7acb95-03af-4f5b-9afb-cbc17e0545fe", "value": "get", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1feae05-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312421, "uuid": "309714fd-2aca-4dfe-a129-f415f300ee1c", "comment": "Malware payload (Mirai)", "value": "0963aadd8f61c32cc4765374ea1003c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312421, "uuid": "b0beb959-56ff-4afc-9d92-d2ac468aeb89", "comment": "Malware payload (Mirai)", "value": "5039c71d74c4fe41aacd0c84df7157636a02459b6b6cfe8b9220c3b0271ae598", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312421, "uuid": "5d82d8dd-e035-4676-bb52-ebc96a046042", "comment": "Malware payload (Mirai)", "value": "4d06ad3e360b4fbd2b364fb3949e921a16d4f18a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312421, "uuid": "37697d62-99da-43d4-b89a-1ac80ac4b8ee", "comment": "Malware payload (Mirai)", "value": "c345a214e69704aab47d8933f8b8b30b3fe053ad4bd6e716466d590a2c5faadc3c997c4e811cef75f14fd78733995c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312421, "uuid": "a6e0287a-6c16-4aea-ac90-f077eb2ffd5b", "value": "T14D43F791FD824A67C2D023BAB75E968D37B163E8D2DB7313C8204B607B8954F1D66F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312421, "uuid": "44ef06ca-74a9-4cfd-89de-4f1dd2e9c236", "value": "768:x0orkV3omaSxJl3ujA8Lt6FXiJp5nu+htAzEkBtjv+GsxgIAmo1ewr:6YmaYJ06FyJp5ntfAz1tjWzg5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312421, "uuid": "b2961c25-59a5-4bad-b0f4-7d571c3a562f", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312421, "uuid": "c920f6a1-2c59-48a2-bd9d-048cfbb73191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312421, "uuid": "d40a06a2-fd5a-484c-affc-e860c5c2bb43", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6af9374-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780293531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293531, "uuid": "4e4cd8d1-0018-41df-85a0-fe122198f8b9", "comment": "Malware payload (DDoSAgent)", "value": "62dc512d98b81b00c3b36a93d8e69bca", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293531, "uuid": "fde22144-4ee5-46e6-be1a-edda63b91f71", "comment": "Malware payload (DDoSAgent)", "value": "50f91a287d0e7a2467d8604f6a6003dc2dc5f1b0debda320c00cd215ad253f77", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293531, "uuid": "5726c6f1-4074-4a06-b225-62cb6e44bce2", "comment": "Malware payload (DDoSAgent)", "value": "c1f92dd89fe139ba8fe80215c89a0520dea0f552", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293531, "uuid": "7da388c8-4a58-4849-b0a4-8432b15fb467", "comment": "Malware payload (DDoSAgent)", "value": "59c0d3a382cccf9911fd7b4a1531e1cf7dc39f47425f5bc768726b8ac1b741b5448e3f001a7561b511d11c4e9292bffc", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293531, "uuid": "81583fcc-af67-4564-97a7-40b213b37edf", "value": "T110860905ADC53BE6C42C5E7444EACA6122B06D140AF2463A26A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293531, "uuid": "85501c00-6304-407b-a524-b733f4ac444f", "value": "49152:6mh61NZIdMpVriMF/0CQhx8wBAqNCBIE17Il8ZkFc55EI:xsLQhxEImDOFAEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293531, "uuid": "1810163d-0a54-4e96-9310-445b1ccf4f83", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293531, "uuid": "acff91bf-2289-45ac-9411-790b37f19a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293531, "uuid": "0a7cb49c-59c5-4cd2-a83c-c67a244ad726", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6da7f37-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346788, "uuid": "61744c6a-104b-4787-a403-f103e9f6b760", "comment": "Malware payload", "value": "83a442e815e24b33ff2e1d74d82e74a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346788, "uuid": "90cab4c6-41d8-45a8-a287-7a8bf5cad09b", "comment": "Malware payload", "value": "534ff18221b4a81ea493f5719ee84e158b3aa436de256bff7e84e821491007ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346788, "uuid": "c34f5a95-d547-475b-a0f7-996aa96065c2", "comment": "Malware payload", "value": "6fb02a2e10edb8aab8e512c94206bf98206898ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346788, "uuid": "85545e00-3900-49c5-b186-446ba91c8120", "comment": "Malware payload", "value": "7fd59e4b408334fe6eefa693e0ff447a7757df6f85718366ea31aac14a2287214719e8a580894a8a2bd4d6f3c5594777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346788, "uuid": "0f0bbe01-3240-49e5-9933-3fa93246513e", "value": "T137E3761E2E328FADF66C833547B74E24976D23D626E1D684D2ADC1142F2039E541FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346788, "uuid": "1efeb27d-9c31-416a-92f6-db077717ecf4", "value": "3072:PRi7YGVAxSNNT35MRpu8P8GnuRgPVU/B17Gj:PRgrNNtA8PRY6Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346788, "uuid": "d3c470c1-24cf-4df5-b96b-b7a48136c2d2", "value": 149796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346788, "uuid": "80dc162d-6c90-482e-8e31-55a663278855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346788, "uuid": "958f0813-e839-434a-85d8-83ca55f3401a", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea336c6-5d73-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780288417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288417, "uuid": "e0305c42-7203-4d23-b670-47ec1a0f3f42", "comment": "Malware payload (Prometei)", "value": "712f9fc3640fcbcd88553578c1a67ded", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288417, "uuid": "aa486a0c-2a6c-4362-b8fb-216fe4c4730a", "comment": "Malware payload (Prometei)", "value": "535760e630fb32e12ae10359225e219a98131afd47484bd64cd5c83b29940e29", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288417, "uuid": "5199d2f1-5c81-42a7-ac9d-e4dc9157edb5", "comment": "Malware payload (Prometei)", "value": "958f5b6841b05e6c1910daa66d5189dd5775a07d", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288417, "uuid": "90326c8f-4613-42e7-acb4-83329e596733", "comment": "Malware payload (Prometei)", "value": "fca5770f9bad3b58cccbfd0a8dac9621191c25d0f0cc13b4e9fa240c7c52987e6375d153f4e5143c6ea0ddb162a94cc1", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288417, "uuid": "029c4b50-2130-463f-a06b-df1215e49784", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288417, "uuid": "0294285b-5e80-4b03-ba25-5b1570589c87", "value": "3:B5rX:frX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780288417, "uuid": "8e7c2b00-2208-4ea9-a12d-e76d67acd9ac", "value": 9, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780288417, "uuid": "441acbe1-4434-4cc4-95d3-cd2cde75f576", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288417, "uuid": "25c708ab-3421-493d-928f-d2b67462a896", "value": "535760e630fb32e12ae10359225e219a98131afd47484bd64cd5c83b29940e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2716bf5-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "5f8008d1-243b-4976-8a0e-34fe06126b16", "comment": "Malware payload (Mirai)", "value": "d5b83460b32aa1124323b483781e3fe3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "bee9bc52-6794-4593-bcdb-b658e5d83ed0", "comment": "Malware payload (Mirai)", "value": "53aac67f2cb0125c5f2d15f449a7ae344022c3a7da79d5a9ccbaf722ff7ed458", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "ada7ead5-fc33-4119-b63b-0d53131e4a99", "comment": "Malware payload (Mirai)", "value": "4077ac2cd7150b4cf0d05b0d7c024f55cad89b67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "23c56964-b146-40a1-b4dd-8d7a9708713c", "comment": "Malware payload (Mirai)", "value": "fe5938945381cd0ab620b5bc9359721d467364700f9103bb90093020b65127b62c66c6d977324ba3c41e4e51bed3f0f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "2bd272c7-e46a-472a-a3bb-9ef9748cc07d", "value": "T101635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "49b661e7-34b1-44f9-8746-c7e9729a077f", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnP4:zGYxpTGASC4XTfyyLpIoYPsP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292181, "uuid": "522339df-9688-48b2-a7e8-00c9819ff5aa", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292181, "uuid": "595ff37c-e2f5-4d2e-9406-4372fc2320cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "a5f2a91e-d9b1-490f-967d-9b11fcf5f65e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86bacfc-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780298580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298580, "uuid": "f6633c39-b2de-4afe-82db-0747b9fd1501", "comment": "Malware payload (ConnectWise)", "value": "80b12f6f89d0b05d98a0be97d120a548", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298580, "uuid": "b298679f-5b53-49c6-815e-4cd7fa02a4a7", "comment": "Malware payload (ConnectWise)", "value": "5525dc40bfb7269f99d0e91daa858a035644fb5e735a8edb8d0bf995fce39296", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298580, "uuid": "26d232f2-ce26-4b80-bb23-4b68c5b6cbf6", "comment": "Malware payload (ConnectWise)", "value": "9f7ff1e233763cdc09176251748425cbfc13cf4c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298580, "uuid": "e73e5e4f-051f-4f16-831e-811f006c467d", "comment": "Malware payload (ConnectWise)", "value": "8473b7b070f97602b55ca273df67e430b83b47cc120d5b7822eb33b0deba2c1fe7dc703f0447a7ac635ca2ab25ef3468", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298580, "uuid": "833a7579-f2b4-4006-a905-a404624c2870", "value": "T1D0646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298580, "uuid": "643b6ce6-8476-4588-9769-1cbadd216ba9", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298580, "uuid": "87c48766-da77-4521-b8ce-17c155ebaa55", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9c:51iw7gryNkSV1hy1Z1u2JLu9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298580, "uuid": "b14501c9-5961-4d4b-b683-053a298db3a7", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298580, "uuid": "81e3a29a-8267-4ac2-bfe3-470b96cef632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298580, "uuid": "d0fd315a-01f2-4fde-b959-9441736cc42e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b8f949-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322325, "uuid": "cf59ec3d-9135-40a0-a7a9-ddfaaaa81de3", "comment": "Malware payload (Mirai)", "value": "fb3a5912cf92c4988d53e7c0ff1b471d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322325, "uuid": "05adeb5f-fbf4-4746-94b4-36dda4481f7a", "comment": "Malware payload (Mirai)", "value": "5643e7fd7708cff1c4bcac0e9e507caf85e7dd10fc09fd08657c903573d30737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322325, "uuid": "94c6e5c0-88ed-4356-936e-a5e9be3d4762", "comment": "Malware payload (Mirai)", "value": "197a322f96b361b976c6e90b0c876da14f2b7fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322325, "uuid": "8ecd6902-5d77-4d60-8f81-ab626a1a50a2", "comment": "Malware payload (Mirai)", "value": "02c7399fe7ead7cd438ef72a98da695d45f75f5f5aecdd9e5930dccfd08600a0c779cbba13c5370ab89be43c7f4d187b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322325, "uuid": "2e9bbae1-eda2-43c1-adf1-6d08c6dedeb2", "value": "T1B013E1CC9F5974AADFCCEE3B341D23B9E690B684618E4B5D8A025C84B83449A55EE03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322325, "uuid": "0673e252-9179-4e3d-b2c0-d575f1d4c1cb", "value": "768:DoIHP73bTPziNKDFDADnUaWHwL9j+fWaAejwz1SSxxUbykiZxW2:DoIznP+yUfowLRgxjwz0SxxUbykif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322325, "uuid": "5a8db31d-8284-4872-9ebe-2724981e3611", "value": 42180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322325, "uuid": "b378cb8e-7437-41f0-bfdb-09f9b605eb5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322325, "uuid": "671cfb5f-c8ea-4095-9431-ba0df62ecf0e", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e132a4-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274308, "uuid": "09b54bdd-c078-4fa7-a63c-405ca5ecf7f4", "comment": "Malware payload (Mirai)", "value": "ab2925b195639b3191076d910f470376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274308, "uuid": "cd9d3a3c-45c5-4297-859e-62745c344848", "comment": "Malware payload (Mirai)", "value": "5682ca82b02e0568245558ea342e7a6a90ff74bf758ccd13631e0e37c2b84827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274308, "uuid": "db9d3f72-6c3e-4056-9238-4fd7695066c5", "comment": "Malware payload (Mirai)", "value": "78c4a7982876fe7805a2723a1ba4c1c417219e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274308, "uuid": "cb2c21b7-0041-4bd5-837b-45a8704dde20", "comment": "Malware payload (Mirai)", "value": "ff02d85011f9c950bd331296a5ff9706af6f3d023be29680df41fbe0ae8e64559a5cbc74811cd9a5292cb0ecb42f46ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274308, "uuid": "5b23ab84-2f51-48cd-a00a-fb05f8129cb4", "value": "T18AE33A46E6408B13C0D6177ABADF42453323AB64D3EB73059928BFB43F8679E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274308, "uuid": "0757397c-79ae-4e43-936b-7e98f1cf757a", "value": "3072:7F6tK9eEaDTzbx8PhGWNFYX7QfK8EBLzrUDM/9kS:7F6BEaDTzbx8PnNE7cKHBLzgDM/9kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274308, "uuid": "d6af2702-9d1b-4871-a5ae-0697ad170836", "value": 154295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274308, "uuid": "55e6dfae-8a4f-4ef8-9f03-f6704619e53d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274308, "uuid": "872ce328-88ca-4668-bfe9-bb174e472b15", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc4fa23-5de8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780338880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338880, "uuid": "121d5aa3-bdcb-4317-bedb-fbb46d0367d6", "comment": "Malware payload (Mirai)", "value": "9a4c5e93c8dd1bf7ccdd943d46228787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338880, "uuid": "3413c3eb-e2bb-48ba-8128-270663e1a50b", "comment": "Malware payload (Mirai)", "value": "56bba0214b4ae013f7202c4579ca038216790d468b3bcdd2548b752a6f3f8ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338880, "uuid": "d7a6733c-6dd3-4828-9357-cb35210c252d", "comment": "Malware payload (Mirai)", "value": "a1952b573c4bba0ca745144085eb58d3ca43ae32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338880, "uuid": "79f8de4e-1dbc-4e21-a987-3561a4f9bdb8", "comment": "Malware payload (Mirai)", "value": "3c62e9946164cc5b87e21f24a6ff5eeaad8f6e498a10b12f960cfadc7ee25da448e0aab5ea558b2c4f81abcaa0aae000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338880, "uuid": "1704672c-8936-4e9f-9a44-283a758a690f", "value": "T1FD4312E15F666812C37916A08F248E89B6CE277BE33D70997146750C7EEBD4451F9803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338880, "uuid": "8abe33f7-81cc-4305-8c33-593d7f4c28fb", "value": "1536:5Fhu5f77ryKan7H5k8deNEDO3QMcZpIopLGV2jRVU8vcB:5Lul6Kan6CZOLcw+LGMNVUVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780338880, "uuid": "f7afe9ad-17eb-4fe1-b8f6-eb9938cb5aca", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780338880, "uuid": "a914fb04-02eb-4d15-90c3-fc4e9ca304fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338880, "uuid": "16152c54-a639-4b27-b4d0-1f0e50eee3d1", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0415545-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780322591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322591, "uuid": "9482fdc9-6d3d-48fe-87ea-5ca44d7efe2c", "comment": "Malware payload (NanoCore)", "value": "e09ff828455cb0d3729bdf4848e52ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322591, "uuid": "f4b5702a-61e8-42a6-b497-582456b23f10", "comment": "Malware payload (NanoCore)", "value": "571f739c785707de4e6fcb5595ff44afbcebd0a9b5ef212018fe6103902c8a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322591, "uuid": "5c239e9f-e8cd-4902-a3a4-b7c9321f7587", "comment": "Malware payload (NanoCore)", "value": "40c034168a80cb9700a0ab7db1baabaa8edbd589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322591, "uuid": "dbd19a3d-e476-4767-93c3-0c80a1c6bbb1", "comment": "Malware payload (NanoCore)", "value": "b0fa58350ed43ebc0345e1bb495e437004a84e17e0caf047849beb91e9552444fb4baceb431ba13ea48981df7da0d209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322591, "uuid": "1907dd5d-cf72-4520-b35f-d672a5d9d0e1", "value": "T1EF14CF5637A8493FE2DE8678602242539379C2E3E8D3F7EE28D855B35B127E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322591, "uuid": "62b09fbd-57e4-4f6b-9e33-682809914905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322591, "uuid": "bb19e248-3fa8-44ed-b1e2-ce01bae0d08c", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIPjskdn+BJCnryIwzt4LLOcs4:gLV6Bta6dtJmakIM5iskxrgztsLPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322591, "uuid": "19b96220-6fa2-4e6e-bb69-484f52ae5d89", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322591, "uuid": "7cb8e248-ef8d-4c53-b204-fdb2bd59473f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322591, "uuid": "c2761cb0-e75c-40ad-aeaa-9457eba23486", "value": "nhyouthclimatetownhall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde60123-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323554, "uuid": "2adbd5e6-81b9-4526-b506-a91554cc9790", "comment": "Malware payload (Mirai)", "value": "38c6a6b598be08dfedaaac5ead9e0016", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323554, "uuid": "a88d80ca-de67-4eb6-9355-58e2bba8fb20", "comment": "Malware payload (Mirai)", "value": "578f3c5dab9cd9b6ca58a635e5c9e717e8331649898c2918dda45f5a613703c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323554, "uuid": "78af6f52-1553-4400-b64e-7a6ed3cd0724", "comment": "Malware payload (Mirai)", "value": "fb7620b575909e352833f24ef11821dc1668d754", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323554, "uuid": "8d83fabc-6f37-4172-b8ef-5f59761e999a", "comment": "Malware payload (Mirai)", "value": "27a2a81dc37d487702f7f66916522ed9511fa106f4ad4278c222266da52574a417ffc5cf40100415e8076e48145b5f03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323554, "uuid": "e01ef790-9715-4709-af34-694f032a26f1", "value": "T160263A07F85191E5C1EAE130C665D292BA717C885B3023D32F50FBB92B76BD4AE7A314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323554, "uuid": "513e6ed4-716a-4008-b2d2-c7b7aacd3dc6", "value": "49152:XBPfbowrb/TGvO90dL3BmAFd4A64nsfJifYnPmvfz+Qi8e74Pz8dDo/j2sWyJ5E/:QKQ/e03ECuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323554, "uuid": "ac3bba9c-a05d-41b6-a693-a1ce1b67277a", "value": 4669440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323554, "uuid": "b3c6db06-5c10-4b4e-9e76-9dd0e0570eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323554, "uuid": "345a3697-2088-4841-a8e2-69f6eaa3ded3", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca55982c-5d91-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780301617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301617, "uuid": "880f195f-de90-4e8d-8db7-5c62b5ef2d8e", "comment": "Malware payload (ConnectWise)", "value": "17da3102a0cb8ce9f0d03d4c549b5a92", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301617, "uuid": "d14f0870-08d8-4522-b753-23a3c88cafca", "comment": "Malware payload (ConnectWise)", "value": "5844fd49b15cfcefa8cef8f5dd5af3f94a25506534585755e0c8c921df4d793a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301617, "uuid": "22748960-eb8c-460d-815d-1a2ea304f089", "comment": "Malware payload (ConnectWise)", "value": "56c0911da76b5a48d09f7be97290906718f477a7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301617, "uuid": "6a42545b-fcae-49fc-a38e-d95590b4e395", "comment": "Malware payload (ConnectWise)", "value": "7ada10071e3bbcb52a3035ac1ba7bcca7cf82ae512ab58b38c895530a291d49c080e65d47178d44ea5ac6ad888c3c7ce", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301617, "uuid": "f0dfe6d0-8d5e-43cb-833c-4969e96580c7", "value": "T128646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301617, "uuid": "bd45a228-b5c3-4a5c-88c8-6bc2a8ac0fa6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301617, "uuid": "d7526f99-b9b5-4cb7-ad21-0c8067c354ec", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9q:h1iw7gryNkSV1hy1Z1u2JLu9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780301617, "uuid": "b54d823c-388c-48fd-a4a4-3a8d43db250f", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780301617, "uuid": "5f5b0ad5-8a19-4107-a59d-3ad1b6f31df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301617, "uuid": "422c15fb-05d7-4ba2-aa29-a0d632d532c4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d156c3e2-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780298622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298622, "uuid": "8d258358-298b-411d-bead-7fcfd5fa9eb5", "comment": "Malware payload (ConnectWise)", "value": "c86132848f210b44b0beb0bef6560928", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298622, "uuid": "70817f2a-6839-4aff-b720-cad7b32614d9", "comment": "Malware payload (ConnectWise)", "value": "588d10c1695f4d17a1357096fca082a45c2dde67c13f22fccec638ceff55eb29", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298622, "uuid": "b39313dc-dd4f-4a0b-9340-a21e8cb2181a", "comment": "Malware payload (ConnectWise)", "value": "dc8f82d2e1381eda53fb32ae1a93dbd432af052d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298622, "uuid": "cf9c99bd-66dc-4ddd-988f-364af56744eb", "comment": "Malware payload (ConnectWise)", "value": "efdafa470e71e76372b2d450ac218f146e2bf342ddfa73317b3a4fbd377130c721ce4daaf296ccd3c7dd9a1e6e4630af", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298622, "uuid": "4a49dcb3-048a-4630-aa6d-2526efa46608", "value": "T15546E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298622, "uuid": "683b0dbd-7d8b-4a11-b08f-23a1c98e2100", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298622, "uuid": "b5a24347-5d38-4e3b-aea6-884d159e032a", "value": "98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298622, "uuid": "b0bf0f88-d8cc-4f53-9efc-de5cce6b2153", "value": 5657296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298622, "uuid": "8906d4e4-46fe-4db4-91e6-a0df95ef2bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298622, "uuid": "ae185499-53e7-4470-b4d8-f40f420df0ac", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e7809a-5da9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780311674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311674, "uuid": "8e063ac4-c8e0-4de2-9058-71d072a35c1d", "comment": "Malware payload", "value": "9581d1e98a03c732d83bdcb99e7714c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311674, "uuid": "c16036db-5cb1-4b14-a119-c2c44e4062ee", "comment": "Malware payload", "value": "5b9f20f16a46833a86dbdaa768adaf8356d6375d19d83d9870a847bd2ceeb13a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311674, "uuid": "47ae218f-e24b-455f-ae25-a137a519c865", "comment": "Malware payload", "value": "9afa9327c92bc90531ad714281f439a9796be4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311674, "uuid": "51f888e5-3e76-4148-9b57-a9acf3ec3a46", "comment": "Malware payload", "value": "0b79bbdd7c47734dfb09bee265420c3e37aba2295e12c191b4f2c4118d3a03c8a2ff2367f17b580c0cb85fc973406e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311674, "uuid": "4aea852e-35eb-48a2-a12c-737fd13923fa", "value": "T1ECD19600A3FC862AE5FB4F3C6CB3131516B5BA015D32C64D1C98425EAC327658A61BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311674, "uuid": "cea25c08-1638-413e-87b4-ad9d14b6c416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311674, "uuid": "71d75277-67e9-4725-bb2d-920bc2ed7435", "value": "96:dZnRletEvWIXRVy3K+TVw790jZlmfUwtCd8drN1EDC:HXMeW6VEpVW98Zwf3dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311674, "uuid": "368e5b15-b14f-4958-98d8-aff1b3e55528", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311674, "uuid": "ce3ee5d1-bfd9-400b-a400-51bf05dbecd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311674, "uuid": "104a42e6-e81d-45f6-af8b-4d30df97b98f", "value": "rfaturar-39383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3559cb1d-5ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780333149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333149, "uuid": "4aa8ee0d-f269-454d-9698-2b0b9d68ba07", "comment": "Malware payload (Mirai)", "value": "84c8727e2a292ba3c8fef02d011d38b7", "object_relation": "md5", "Tag": [ { "name": "aarch64", "colour": "#A554CB", "exportable": true, "hide_tag": false }, { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333149, "uuid": "1301c7d9-ae43-443c-b488-66fc87eaed88", "comment": "Malware payload (Mirai)", "value": "5bf67d64e94a8ed6b81a0855fee52626eb0f4caf1772518fc2404883030451c2", "object_relation": "sha256", "Tag": [ { "name": "aarch64", "colour": "#A554CB", "exportable": true, "hide_tag": false }, { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333149, "uuid": "65263a46-e11f-4050-9ca8-ef1ad1e0d0c6", "comment": "Malware payload (Mirai)", "value": "c0d2045c95f96ff6fa24bc4565c076faf6dfd310", "object_relation": "sha1", "Tag": [ { "name": "aarch64", "colour": "#A554CB", "exportable": true, "hide_tag": false }, { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333149, "uuid": "fb184591-a424-4b93-9eae-38622da6cea1", "comment": "Malware payload (Mirai)", "value": "c81ece6e1a1a711b70e27c6246fa2940e269ca30f9c8ec84b444f7dde5afae9f30c3f9ea20ff52f72e9e7c4b256a55d2", "object_relation": "sha3-384", "Tag": [ { "name": "aarch64", "colour": "#A554CB", "exportable": true, "hide_tag": false }, { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333149, "uuid": "ee8d1387-7c87-4c33-a503-52e71c28aaff", "value": "T196969D42BC1E7863D6C976711F7612943239AC499F82D3126628BB3DF9F2768CF13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333149, "uuid": "44a1ec9a-8500-4cee-a816-ce5c33128bc3", "value": "98304:aHFvHRHSf7/4onlmwLmRPWwsEiqvFs2y4fs2sqEEp/SXw2s:O5yD//riRPtNvF9y4mqbqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780333149, "uuid": "65a16e7c-a7e7-4690-9d40-849595abe31f", "value": 9122844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780333149, "uuid": "73c7a746-f16c-453c-aa20-80d5bfa9f569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333149, "uuid": "a626d52e-6341-44ae-a68f-191816677ca9", "value": "c2c_agent_arm64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e333a6dd-5d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780283620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "0cf49efe-50cc-4490-8bda-ebe4349850e9", "comment": "Malware payload (Mirai)", "value": "db326f41279c5fd0863ef8375875b2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "78cd365d-707b-489a-beb3-44c9a83cf91a", "comment": "Malware payload (Mirai)", "value": "5c501efadac0000afee68f6e6b8c362f20d66734f036ab26ea23ade50fd7cf3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "91d043df-049d-4430-bcbf-2c8458deab9d", "comment": "Malware payload (Mirai)", "value": "433115f68ac8718c3e7709ff20d3d2b46e5faa84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "2fc692df-b748-4cd5-8911-02a592675775", "comment": "Malware payload (Mirai)", "value": "1d87f36448ca03b418bb05f52968147ac797710b1cd40ebc9a9cd2cfef84f330504e4a9c76ba2a9c9e3e649b75986c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "8a7830b2-7101-4500-8623-17dfb01f9d66", "value": "T1A2043C49BD928F11D5C622BAFF5E428933132BB9D3FA3102CD246F5537CA99B0E76211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "e33c920a-07ff-4c18-a473-5eda0bff35d9", "value": "3072:ooQGUt5OE4dtw4UZ/Oy9NZDPlHPwIImY0cXcJ2bOHO7aI6n4A/nGXccH2KLCi7T4:ohp5OHrlHy9NZDPlHP1IfdcJGOu7aI6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283620, "uuid": "9b4bf63f-32ef-4a7a-ace6-faea4eab0632", "value": 178820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283620, "uuid": "2fe9d87e-b621-4162-976d-4a4f94238189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "09a598a9-f268-4339-8685-1c5727512bdc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d570ce2-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "f7847529-b392-4ad9-a493-66f2a8c6e6c2", "comment": "Malware payload (Mirai)", "value": "1203eaa1dec3437be9baa479b7573c9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "346eaf4e-306a-4ad8-adce-c43d8e50247b", "comment": "Malware payload (Mirai)", "value": "5dac656868fdac9b83d4c890d4a8c8d03a42374baabceae0acd390ba37cd74ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "c5071e53-db65-4e6b-8e89-51d6b24b465a", "comment": "Malware payload (Mirai)", "value": "09b37d99d0bccc4002b2e682408b22255a7b865b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "ae915519-ea2c-4cfc-8cb3-827c6e281f90", "comment": "Malware payload (Mirai)", "value": "bbc229388948820e5e83a15d526ba9ef1dafa13cce4f6c13e3cdfe1e77ea40eb3c41dd2fea21894c79db48d5d1200063", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "5b363aca-0854-4e57-9a76-557977011e6c", "value": "T116434B4DF783F0F0ED4E0671111BB77E86389E125014EE6EDB84BEB29D31A12A52B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "9884ab44-41a7-4c18-9497-55287fa7fd84", "value": "768:nHvtsjVITW0h0EbptRV7HYr/5Hs95o5maZygMQV8RBzqD17fZAPxpEepSVMUYc3W:nPtFhX4D5Hu5o5mOu47hAkMUh31AOGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292898, "uuid": "ee5b33a1-2d97-4556-bed7-e5e7ad5b9692", "value": 58256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292898, "uuid": "cb17b083-2d60-41c7-a6f1-d71677fe970f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "b3803559-54c4-4efb-8d39-e7f6c24da6d9", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e551b623-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "ce8164f2-0431-4148-9877-028b6416b279", "comment": "Malware payload (Mirai)", "value": "2b0b0351e5bd989aeff0d3c6e7158ac0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "e6ce686a-73fe-4383-9710-a2b28e68b820", "comment": "Malware payload (Mirai)", "value": "5ec333647d4946c22672778debde2c126e1acdd932d3c6665e19cbb7f549014c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "e052a1eb-26c4-4b9e-acde-acc8be56a05d", "comment": "Malware payload (Mirai)", "value": "54a589df2d5a34bea4990a25e8bee2493a9ff745", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "b5445342-1fe0-417f-9a07-657696fd4507", "comment": "Malware payload (Mirai)", "value": "b0c0d3c307f57c46a19f157da2108832757fbaaeb51bae4aa99f4d95cdb232cab5afc389788888fb7bde3fb43c4387f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "37fc85e0-50c2-4e0a-bb60-514068423407", "value": "T12C23F278A108CDA3ECA92B3AD92D46C06E890FF9D43AACA513CC09B0975743C6CDDDC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "9c14e2b8-ecfc-4977-9810-ded2cc6e24d5", "value": "768:dHjvD8lxlui0xDOUI4ONiCy/8GupOfspvCqLyr9EW6NJ/9q3UELQo:dDBjOtzNiqf9pvCahNYLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312399, "uuid": "38fbb0c8-15a2-4d75-8c3b-d695962549f3", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312399, "uuid": "122bb9fe-60c5-46bc-9490-302734d11662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "9a8104f7-96ce-401a-aaa8-51a2492fd023", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18810a28-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274260, "uuid": "c17d8a9e-8557-4036-8cf5-097ba29241cb", "comment": "Malware payload (Mirai)", "value": "adc0d93067a4a2c0862679702395fbe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274260, "uuid": "0c5be4eb-019b-4c16-9cc2-2734e8f195b2", "comment": "Malware payload (Mirai)", "value": "5ef9fcf9d8d2412fa54867f7c29cfc4cb967e9cdddb87beb4344e549bd185ff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274260, "uuid": "a6817544-fde9-4414-9671-676bca000fa6", "comment": "Malware payload (Mirai)", "value": "1cd73a06de6da4ac8564bd84069a7595ff4d8f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274260, "uuid": "b4574368-48a2-4b84-b281-1f46e68a7bd8", "comment": "Malware payload (Mirai)", "value": "3e39a9f664bcd02320fda3a8fd78a178fbba186c07bb9465355009a434ee92f03bbd2a4ebcf10e177002d45d14987026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274260, "uuid": "cb3ce7b6-0b81-4b38-86bb-ab0f22f343f1", "value": "T14CF2E0FD85CCF84BCA8E5ABBA12F17600A05B168331F5E9C63528C98B5765C5BCCE0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274260, "uuid": "d8affd8e-68a0-466b-a0cd-abefd65d94f6", "value": "768:Jcic7wjLh9rKj3/orkKPx3Yq22f3jA1PAw0mnH7Y0nEzmHfabPdWT:uqSj3grkux3YB+c10mZDfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274260, "uuid": "9400394c-33fc-4623-8723-d155a897f79c", "value": 37168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274260, "uuid": "eb75c7ad-11de-4a1c-907a-fa5027642a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274260, "uuid": "4d350f0a-a575-41de-843b-c920c676be4a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f04bc7-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "e5a48d89-8698-4965-8c91-7b002efd5f2e", "comment": "Malware payload (ConnectWise)", "value": "ef96fcd7798e53f952033a79c1843813", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "ac0a58e7-ef1c-424d-a4be-2acb7c755117", "comment": "Malware payload (ConnectWise)", "value": "5f178a9596d1fc74ebcdd3594b320cd77839a56239947ef682945538491bd680", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "aae93873-7643-4269-a70c-ccedcb38207c", "comment": "Malware payload (ConnectWise)", "value": "a6b13e0ae95a2f41d429bc9fb19887865c3db66e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "b41d1df0-4048-4744-98ec-b6e62af703aa", "comment": "Malware payload (ConnectWise)", "value": "ec757d3058940678acc8a9cd707de8e805f7003cd98bd47d6d693eaeaa24057db2cf83e674472ed7d9f587387a6191ed", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "1cb3a48c-1ab5-403d-b7ec-fbf14ca07c26", "value": "T142646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "555d0d95-7075-412f-9b5f-d1ef1d266808", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "b7ee2d64-9365-4a3c-9f0a-0d0bbd39a245", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300031, "uuid": "586cae66-320f-42ad-96c9-39249e98b33f", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300031, "uuid": "09861df3-3fef-468d-ab69-ec71139d45cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "9ab4f8a4-77b8-4801-a702-ba469e005fc9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa402b28-5d5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780279658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279658, "uuid": "6c59116d-6c4b-4622-a5a4-e05f57cf9f57", "comment": "Malware payload", "value": "11e9a566ba95a9b864a1dd309b5d14d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279658, "uuid": "99f3dad3-22f1-4b74-b590-a56a948d32c1", "comment": "Malware payload", "value": "5f9d0b9e9e106f6d388fa6414e6021bf1d5afcd0e3095266c79eb417157ff6c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279658, "uuid": "a754f0a0-3e96-4661-ad2f-e067560560bb", "comment": "Malware payload", "value": "3fdfe4ab43e15752aaa0f80e40ccdaafbaf059b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279658, "uuid": "62bea1bd-b494-4186-b3f6-92ae8bab6302", "comment": "Malware payload", "value": "b175b64c8883d7479aae0c7f874d1825ea48f4ac9f9c05f115371effc4e7d69dd9b3c58cf6a0ffafb660efbf5cb43a2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279658, "uuid": "273e40d8-425b-42c5-a7a9-78946e381695", "value": "T17D136C6526953C25AE99883B5D7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279658, "uuid": "275fa1ef-84d1-41c5-a51f-3d3d6f166af0", "value": "768:Ir9NyXsZztCM9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:WHusZYcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780279658, "uuid": "d0bab599-42e8-4ec7-81a9-194dd570f9f3", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780279658, "uuid": "012baf61-b46d-4949-9579-e4bb45dda38d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279658, "uuid": "05c7f258-160f-4e21-bd5b-40b5fdb7a98f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aad274-5dbe-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780320832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320832, "uuid": "8df9caa8-2b1c-4dc1-974c-255735bf93d8", "comment": "Malware payload (CoinMiner)", "value": "23f67a641b3f622f051839852f1e6ed6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320832, "uuid": "d589d7cf-1262-4b8d-b1b9-f91af9fa5d1b", "comment": "Malware payload (CoinMiner)", "value": "5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320832, "uuid": "1776de74-dd01-4de1-8ca4-91b2d9a73772", "comment": "Malware payload (CoinMiner)", "value": "829f1ba9e61a4db810cbc9aee89a1cb131f448ca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320832, "uuid": "9ab601e1-e72d-48e8-b96a-214cf06f020a", "comment": "Malware payload (CoinMiner)", "value": "860bdbca3135164048d0d83be1aa4d450ae242400573a5fce20b1248240b559566a4643b2c8111b4d491cefc5bb2bc11", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320832, "uuid": "19546411-453e-4293-8427-bbb137a4eb27", "value": "T11E32711C2D460331EE5049B8E8754246657C2EE3B397EBDBE633E6CB49D6E4488C192F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320832, "uuid": "82c0d251-81f7-4a57-af83-831482a91653", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320832, "uuid": "22f896c1-4ce4-4491-81f6-d10e2a69e986", "value": "192:LoPWLS5BQqCxSHO8jZM0KbPFJxTEZmFhqCc:LoSqCsueMPbPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780320832, "uuid": "5b8aaba2-51f9-4708-8b2c-0d90dae3aaba", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780320832, "uuid": "03da5da0-7e75-4793-9ff4-db6c19d3fac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320832, "uuid": "b2508a67-6308-400a-b295-7c8602cffb85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29030da0-5d92-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780301775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301775, "uuid": "a9fa978d-6229-42d0-8044-3006c931473e", "comment": "Malware payload (AgentTesla)", "value": "15f5849792cb37ba7191b3f98d714e8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301775, "uuid": "917068f2-ab61-449e-844b-02f3ed16bf47", "comment": "Malware payload (AgentTesla)", "value": "600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301775, "uuid": "146b9655-cb2b-441c-9617-44df392979e8", "comment": "Malware payload (AgentTesla)", "value": "dc1628df3444de85acd7cd05b3b2f631dad4f301", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301775, "uuid": "59d9754b-1fea-4b95-b59a-4a7389c5d01f", "comment": "Malware payload (AgentTesla)", "value": "77891cf3598ef1a6939a07442a4d0bad149410262ff52e3901de65ca849d37ddd1b7f30b2158fa09355662395502364f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301775, "uuid": "6711af31-b541-4d51-b906-74d4c5f1a637", "value": "T12B645B20ED24067A0F471799FDAA0B61CABDC219863654F5F6DA030D610A5FCE3FE369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301775, "uuid": "d8f42252-a2e5-4134-8fbe-02eb0a5a1b09", "value": "6144:9Sdgu5IKWpL2rKD+Qae7Aee4hIxCmki41slm7C8686BYRR7PLRaUftHe6H:25IKWycmeKu1s0t7TRaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780301775, "uuid": "7ecf5ed1-4a37-4461-9cd7-08b02f8b6aaf", "value": 324953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780301775, "uuid": "a4e9e9da-3b32-4803-8883-c3954dba7dbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301775, "uuid": "0321648f-16fd-49fc-b4de-bd7ba6cd16c1", "value": "Javasolt rendel\u00e9s-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb2a8f0-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274267, "uuid": "4b6b1bdf-d558-4100-9640-831f718c79dd", "comment": "Malware payload (Mirai)", "value": "9bd416985f35206ed39595c5184c6573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274267, "uuid": "e58c6143-c379-452b-adbe-5a572df6864b", "comment": "Malware payload (Mirai)", "value": "6122261bf53be19b37dbbc4433af826d3414ba9ecf73be3b77a40c2e16efedfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274267, "uuid": "eb258d8f-0303-4731-9762-0e94b14fa5d9", "comment": "Malware payload (Mirai)", "value": "da5eb316efbecc5f0a1ad02a6ffa2de580b25b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274267, "uuid": "20ad1d19-3fd3-4150-9d71-03637c566c57", "comment": "Malware payload (Mirai)", "value": "f54fcd6fbf04c05e967095cd65b7739b96e61547d7f5a6a3004899718688916f285455419bd4f6b6c419092f05f053a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274267, "uuid": "11ec8eac-2737-4600-9389-fb2a856b0d9d", "value": "T1597329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274267, "uuid": "b6e120a6-18b9-4ec4-abc2-b22c04f5baf3", "value": "1536:z3OL3wr34Qu3EhvOy0sxomxjFH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxomP4cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274267, "uuid": "145b604b-5b63-480c-be0e-50751b56ff97", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274267, "uuid": "f1382edf-6709-4dda-9e75-728250999787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274267, "uuid": "0a579c15-ddf2-4df2-90ce-58490dcfebeb", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db901051-5d8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780299069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299069, "uuid": "f20d0371-83d2-492e-b1ee-fd946de83526", "comment": "Malware payload (Mirai)", "value": "408ed1473ff73b28f3c271f4e26f56cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299069, "uuid": "18cc554d-8d94-4380-bab1-5b8c5847a816", "comment": "Malware payload (Mirai)", "value": "61790b6ca28e2ed4893fa90c7d2bd8a9a871fb3f1c92fdfaeb12e3da8c12cd57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299069, "uuid": "8ca2a2e9-cd15-41f8-b658-bab714fb96f9", "comment": "Malware payload (Mirai)", "value": "1f6cda2f25a6fd05a46119ef7e2ec44ef3266953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299069, "uuid": "fe1ee32c-b883-4f08-8b47-4c1598cd0e81", "comment": "Malware payload (Mirai)", "value": "eeae12ff88057a8f27f0f49627a8dd5a9a4c0764fccd17c787d1628adcc39e14b095a8b5ec654ebebdca95e87c99697f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299069, "uuid": "38f22577-a73f-457a-b8ec-6f31b2054178", "value": "T1FA735BC5A743D0F0EC521675447BA3528E76E4365639FF56E7AA3A32AC03B009E1B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299069, "uuid": "120e4e8d-29c0-4018-aff8-bef817991e25", "value": "1536:SfJDI3vVWqcRAhJtz+Z57UiGKUEhCUKClK8qkJfHvDEdReedSWE+:2JD89WpRglI7UBKUHwVfHLskeh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299069, "uuid": "6ebac8aa-3a57-4a32-a800-b5126ef86bac", "value": 78960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299069, "uuid": "b2fb2123-e821-4bdd-baeb-1d366c77b55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299069, "uuid": "772b2854-e164-4133-9812-86a89897ce60", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860d8c2b-5dda-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780332855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332855, "uuid": "bd7c7733-49a9-4f80-97d3-e3ae7e99dde7", "comment": "Malware payload (Vidar)", "value": "7ed6dee38a2ca2e0ec52b494c1c5fee7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332855, "uuid": "69d2fbd1-bc24-4390-b50f-0e6a7569b0ad", "comment": "Malware payload (Vidar)", "value": "6263723c1849b036c184b491986fc2532fde1d7a20081b328865671fc03afe3f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332855, "uuid": "c2ecdfc9-29a2-4274-a25d-93fac9c5014d", "comment": "Malware payload (Vidar)", "value": "f298ee13674ef2bc2074c3f4385658dffafd6126", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780332855, "uuid": "9aad9759-b578-49e9-924a-6255361aa67f", "comment": "Malware payload (Vidar)", "value": "78388f870448880fb2c2af3a17b5df6e2b125de136b9d17acf5ed412e20f2094a16066b8ae4027729d9c723c7990dd40", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332855, "uuid": "a53d4a6c-a0fb-4527-8c8b-281772385815", "value": "T190D539877863F2A4D854B1F7346381747768BC257B74A7F7298C26B607311C80AE6FA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332855, "uuid": "a890187c-0fb6-40a5-9213-9ac21c3a5976", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332855, "uuid": "0e168102-4d6d-40be-97ef-4a8a45d8f022", "value": "49152:n3zCvNBHtjzG+pPN8HpvwC9FOO/YKf+iPz0mnmSNA5QZ+msgDUN7K1p:ONBHtjKiN8HeDkP3ZNA2Z+N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780332855, "uuid": "bd822979-bf91-423a-b374-ea9f001ea16b", "value": 2770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780332855, "uuid": "2bf65ca4-f96f-4cb7-a67e-3b983edffcc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780332855, "uuid": "41ebbfe3-3821-4166-bc54-eb1535878596", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc0c1a6-5dee-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780341589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341589, "uuid": "fa688e1e-3312-4890-8b48-8eb37d191196", "comment": "Malware payload (Phorpiex)", "value": "f8c56e286c45c2b6d08b25f487eab6cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341589, "uuid": "845b4872-34cd-441a-a795-51d3624458b1", "comment": "Malware payload (Phorpiex)", "value": "638bee1130007af009e628efbd6aed9b7b0c88c9184513e1928cf7e0eba215e0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341589, "uuid": "f195a847-b8f6-4783-8598-5e5b2196294c", "comment": "Malware payload (Phorpiex)", "value": "5edf095e03b3ed8dc9d27a74b85aaaf82a1d48c5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341589, "uuid": "b7be53cb-b0a0-4581-8327-04332bd7dce9", "comment": "Malware payload (Phorpiex)", "value": "85177bb10d10991e58ee88c873eea5ccd0330efd406f3d1e17f05078038bce530b836e45efbd0301543d5a6fcf632475", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341589, "uuid": "bda78c81-be69-4ea3-bccb-c91108dd5484", "value": "T133B38E1030C1C432E566117988AAC7B98A6EF8710F756BD7FFC406AD8F366D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341589, "uuid": "447043b3-9e30-4603-b2e4-b26b73600c8a", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341589, "uuid": "e22b4029-69df-4858-9706-39d46f3dd22e", "value": "1536:TjKtSmJd7d52Dr59gzmkVa8S9rL2sFTfEcvSn0Mv3fx/h5Km26E8Yj29:nKtS2d6oS8S1LFTfHm3fx/h5Kmuzj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780341589, "uuid": "004e7f27-1574-4117-ab19-89da23252582", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780341589, "uuid": "074804b0-386d-41ee-ab1a-5c3e73958bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341589, "uuid": "6a8ec174-b8e0-4acf-abab-a07638c31577", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711ac046-5d74-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780289012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289012, "uuid": "b95c45c4-1b12-4bdc-8cbe-a8f8874cfc3f", "comment": "Malware payload (a310Logger)", "value": "0955421548723dfb8f258d6098c8eb04", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289012, "uuid": "bb249665-f4bb-43a3-b729-b0946867f642", "comment": "Malware payload (a310Logger)", "value": "64f8fb4e7433f3c6a73c66b90f60e3e96e4a5ea42452d176c6eb980cd049773f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289012, "uuid": "c17a72c4-bc84-4e55-8c20-450d11efd844", "comment": "Malware payload (a310Logger)", "value": "6cd156924afa8bd377fbb6707e706e4532a6d5f9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780289012, "uuid": "ac60b328-0154-46f8-8a4a-4938564aa4ed", "comment": "Malware payload (a310Logger)", "value": "ba68803bf140ffa26e65204b7765bd4206a547f178dde29d92e23252774073d1883810c4d90b667f8101549666ef7879", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289012, "uuid": "d560cab0-9134-481d-a25f-11f3a676552e", "value": "T11405CF6522868F1AC94F93744C6F5B80E263EE125D3547C3DB472E6CF6BA666E1C0E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289012, "uuid": "957ce27d-a0af-43b9-b246-c4a9d26ef770", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289012, "uuid": "31812e1c-41c7-4bd8-b0a3-a195d31431a0", "value": "12288:jpKl0iVI+1GdKzABoVsqOJRNSwZYd1C1FNLHPGB:gl0AI+1GdKzABouqO/NS4i1gPGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780289012, "uuid": "5d1da95c-60fe-4ab3-ac9e-e3bc4ad35f42", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780289012, "uuid": "a1f5b982-8aeb-4ebc-9bc5-5f85a51e8647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780289012, "uuid": "646ce480-8dd2-461a-9971-401a67ce901b", "value": "material list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684b334b-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "8325ff1e-2096-4382-b200-6859d71f545c", "comment": "Malware payload (Mirai)", "value": "56446cc20c4ea2c206007f8ec3137144", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "4afb0467-0944-49e9-89f4-b339581e8357", "comment": "Malware payload (Mirai)", "value": "65b02af6af320d2c621a69ef029f7acbc1217ad085044c8406838a67fdae2dc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "8d411c17-46d8-44d9-bf4f-7689f016f067", "comment": "Malware payload (Mirai)", "value": "142516eef0d362fbb7899b09c25f2be9e78ac85a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "5fb093bd-fc69-4c3e-b990-243c83d06c48", "comment": "Malware payload (Mirai)", "value": "b39719e6d10f9e712a4e0433189a1eda2286e5d4231d1e34a0cad2b085284ce5eb575fba8818fb3790ed4e4dc47fba8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "09d4f96e-dc96-4ab3-965a-f221cb3c1a0b", "value": "T173C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "e21b9fbe-5cb8-46df-8cc0-05943ef01a27", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3V0j:IaOulLUUogcQ9BvMEWSWC2h3V0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293721, "uuid": "0b1f2893-5d55-425a-950c-78a2f6bcd28b", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293721, "uuid": "6597519f-c15a-44e4-9ca5-0e3b1c400eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "60229fac-1515-4496-9716-401231305a98", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4d1aa0-5daf-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780314322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314322, "uuid": "951c73d4-723d-414e-8622-d365ad7a86c6", "comment": "Malware payload (ValleyRAT)", "value": "daba4296774c06390e34009dd8fca08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314322, "uuid": "64c84f46-5b3d-4c07-9600-94a3c96080c8", "comment": "Malware payload (ValleyRAT)", "value": "66190c82b66b183a68722bebc38c787c360b6a1bb165049f788dbe512ca29c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314322, "uuid": "9f9fbf07-a038-4af4-b703-35ef24829671", "comment": "Malware payload (ValleyRAT)", "value": "8b9ac136a727ab901e2682591708eae63a13e8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314322, "uuid": "39e544d7-5db9-488c-a215-51e816cd762f", "comment": "Malware payload (ValleyRAT)", "value": "2ab590d5333bc66291198ad9f5086e30fe20a61d5180bd87ab78d8938bcbb73124980803a70cdeac6dfdd818cc7c7307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314322, "uuid": "2741614b-7ba6-453f-a88d-6d4625d717cb", "value": "T105C51BBB7222CA6CC0CACAB42497D7A16F207D1404A5134676CE2B1F6FB7D401DAD9DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314322, "uuid": "08dc44cf-aedc-46bf-8d7c-c92c990386e4", "value": "4d07d9d2fbb657163e3e9f6999b13394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314322, "uuid": "338e74e8-2a12-439f-8d16-40769950374a", "value": "49152:V9L4yTrcd7aRbqOImCEzT5/mlV5a8JROuBziwT08:LL4yTJbqONnzO3BPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780314322, "uuid": "54ee076b-15aa-4fe8-b49d-291bf54d067a", "value": 2729472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780314322, "uuid": "e619863f-2932-490c-abac-bc956577c1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314322, "uuid": "81df8573-3884-4462-9bbb-b43cf8137aa6", "value": "26529000001026905011_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c37f2c-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "aed32b05-93b8-48ad-9d5f-dd4b9acbe38a", "comment": "Malware payload (Mirai)", "value": "39f21f73068a3ac95c2c2f741e200e29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "81b27e1c-c5ce-428d-ae37-c0f8930f81c6", "comment": "Malware payload (Mirai)", "value": "662e3497f26fa00e37606eafaf941b6566f0800fde43edf8c8793db84757f63f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "c8073231-81f8-4e1f-99ac-b6e6f390a4fc", "comment": "Malware payload (Mirai)", "value": "d2ec966d04a4b133c0ddb61a21bdc9af51223f86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "11f73152-f7c9-468a-9968-22554ce917ea", "comment": "Malware payload (Mirai)", "value": "13e25a6d4f6362b32a4533bb2d552164769f19f20c9c8cb4a757c8a47a3efe6419359f6e6d0f79ec2fcb20de9b199ad6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "e3224875-3b8f-47ec-9142-38af64e96c27", "value": "T12A933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "ba8082bb-b8d0-45da-8c8e-3f143531b0ca", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DNK:eyxt7W+G+3QBBntmzg6d7WidDNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291509, "uuid": "ec828176-d918-495e-9657-dd133cb42ab8", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291509, "uuid": "4511e866-93ec-46f6-a3a2-58fc59aa6fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "5f5c95cd-6e97-4c59-a3e0-494d6b499ced", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9c69db-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780293915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293915, "uuid": "ed96548a-cde0-4c6c-971d-063290a1429a", "comment": "Malware payload (AgentTesla)", "value": "205bd0b0430e3a3586ccfbcbea2fab1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293915, "uuid": "e525cd3e-087b-4d59-b74d-ae7a74961591", "comment": "Malware payload (AgentTesla)", "value": "6675f584fa0367de00bf0f46fc448c29b6ab7ef8c84df6c0102d768ca2394cd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293915, "uuid": "30c923b8-368c-4fb0-bdc8-c02effdbe18a", "comment": "Malware payload (AgentTesla)", "value": "12ae1d7cda7e88edd2f7a11a67225571fa8fc6be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293915, "uuid": "b275e4fc-6840-430b-a8e0-a163ca75880c", "comment": "Malware payload (AgentTesla)", "value": "0588e6f965d7db20e0f3b32788c7bca037baa4c11dedd6254c3ed3d308fcbb54b0187e1d3db97bf0bfb67f5e090dd158", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293915, "uuid": "6c341de6-93a8-4008-bb1e-6bba459a529c", "value": "T1FC35F1102E472F14D57D1B7CC0A21444B3F0D94B83AAD3ABBEDD50F8AF93B89C95A5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293915, "uuid": "4bb7097e-4d0d-4922-bde0-b6e90f4fb01a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293915, "uuid": "102641d8-5ce4-413f-9ec3-8c332d691622", "value": "24576:aEkRjb6e1AaPedLAR0Uq8FOzPqHEQCvoGF7YMBT:D+jbNPe/Uq0IqHOvvF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293915, "uuid": "4be28c69-8c13-46b1-8756-21e90ce52303", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293915, "uuid": "d2ecea09-3ccc-4345-8f2c-cb505e2d825d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293915, "uuid": "50a48bf3-819f-44c2-9717-56ef415f1ffa", "value": "Copia de pago TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6508fc96-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277824, "uuid": "5b90b08d-7000-4607-8542-7a7e9a18e530", "comment": "Malware payload", "value": "8e6cddd5333867238ee0df02f87734b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277824, "uuid": "6ef98b37-d282-432f-8122-539e6b1775af", "comment": "Malware payload", "value": "672adf56b1742970a51d81d7afa918ed83fc63fe9c2e5b7b08cf5efac2cf79a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277824, "uuid": "1488edad-eff4-43c8-a05f-3cc8f9a50750", "comment": "Malware payload", "value": "cbe0747501ecff0c2f8005c46d0577719c4522cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277824, "uuid": "22c24c0b-4734-4ae0-a713-73da0f3964eb", "comment": "Malware payload", "value": "0f46c980a8366da4936f815f656a813d2ad0892cc431a74fe49f56e71bbec228085ae45cab3e5c18b89219010261eff0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277824, "uuid": "5c55f7f9-17ec-4dc8-9c7d-878c3c1c28b2", "value": "T1A9920B2577EC9B36EAB75F78E5B5C12412329B81A402DF191CAC60DF45DAF818021BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277824, "uuid": "b6509106-7697-444a-8a35-b50987c01e68", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277824, "uuid": "d36f8840-9863-4526-b220-feecf8618829", "value": "192:00jOLvJtwGJDb13LljWQp2p5XL2Iz+iTuyeSd1SQrtHZcVS2q+acmyv66cfjcRxV:Z5L29wxzJt5cVuyBcLUEZs9i+lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277824, "uuid": "211263c5-6a6e-4441-bcaf-7d92a288ea40", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277824, "uuid": "0e12a45e-a28c-4ab6-8174-36bf951ce193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277824, "uuid": "ea4fcab7-83d0-46de-882b-1c055fa97eea", "value": "672adf56b1742970a51d81d7afa918ed83fc63fe9c2e5b7b08cf5efac2cf79a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf250779-5d59-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780277546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277546, "uuid": "c8b13c9e-4e85-4b2e-96b9-c6d93cae3dd4", "comment": "Malware payload (Mirai)", "value": "394dc847045b54381089d18e59372b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277546, "uuid": "42c0f5c3-f075-4b5b-bd08-60f47d7e91f5", "comment": "Malware payload (Mirai)", "value": "679108c9ad9b5407115b6ffbdc84a26d8a15ce1d097d0a0050e4671d9ace6655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277546, "uuid": "9d25b668-d863-4a9a-ab9b-84fe1c70ad0b", "comment": "Malware payload (Mirai)", "value": "a370a27198355654eeded197427affcd4784d59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277546, "uuid": "ed64e5da-2e4c-44fe-8a40-c9bf8b9e5f66", "comment": "Malware payload (Mirai)", "value": "081e750f4711688e44e820ab234c93c3bd5439c47a13f8a2817d7dd47743c4a8c16965329e26fa138149a452a358e615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277546, "uuid": "49cf7bf6-538e-40db-846c-b0781ff7d102", "value": "T141566B46BC1E7463DAC979712F6612943238BC499F81D7132618BB3DFAF2768CB13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277546, "uuid": "afce8170-48b4-4593-a250-13b29b06d86c", "value": "49152:T/bM1epp69Wzdj9NXhh0UfPdWFaZNTxQzR+CYibzD5EO:T/b0eX6Kd1h0yYvRPYwJEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277546, "uuid": "f11b2477-8d91-4d36-abc4-40b7e5d562a6", "value": 6291618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277546, "uuid": "634a87ad-7b2a-47d8-a93c-22df5a1f3160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277546, "uuid": "272bd0eb-ffd7-4655-8dab-4522fb9997f1", "value": "679108c9ad9b5407115b6ffbdc84a26d8a15ce1d097d0a0050e4671d9ace6655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66293c5-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780293530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "1db99b5e-a736-4a7c-acfb-4fd0d4532916", "comment": "Malware payload (DDoSAgent)", "value": "4e0f1278732db330fb4f2c3b3d453799", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "bf6d3cab-a547-4eed-9521-100f60c8341b", "comment": "Malware payload (DDoSAgent)", "value": "67b10f9dc1b4d9f4dca09dd71b8a51d7fb1b3d266ef39d0dd9e0fc95fb27a551", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "03b0004d-1223-4147-b1ef-a40e6aef903e", "comment": "Malware payload (DDoSAgent)", "value": "21d94063401bca35e6ca59e6cc86939712416053", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "c4bae68a-91d0-42e9-9761-f810951035c6", "comment": "Malware payload (DDoSAgent)", "value": "9f6e3dd3f5db6672a5e952dfa03a6578cb93e5d1f003561f682b6f45e1ee80fc0597ab07dbab94089d3aae980b118b88", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "5bfd0363-37b2-4e76-b148-054f60306f07", "value": "T1A0767C91FB48A136DA460A3248A70B30B3915D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "88be6e72-77a5-4bfd-a5eb-208ae11e04ab", "value": "49152:3YZ/SdCnVxNaPnN9a0dqNHWkyIQlTyUp5dIZiHVRW8PwyESHMEwOBHHUt5ER:aZnrgN9r8HWn+wC2i8PsSsEwOBnUjER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293530, "uuid": "13002747-a631-4240-b539-cd53108d9297", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293530, "uuid": "537b2025-b4bf-4bef-8e30-541ead470b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "41bb4844-6c9e-4cee-a1db-7e6f087ffb1e", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398c700b-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274315, "uuid": "3fc2983a-d5e3-48fb-a8d8-1b07ad7ab562", "comment": "Malware payload (Mirai)", "value": "de2147c9c8536eabd9caa3a4f08516c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274315, "uuid": "b6aa570f-ba01-43d4-a91f-7af68cc72848", "comment": "Malware payload (Mirai)", "value": "68c04809c8098ba079ebee8d5e0c200e97ca7895f100a865fd02790e34db7344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274315, "uuid": "72fa8315-94ca-4727-b01e-df2e86fcf96a", "comment": "Malware payload (Mirai)", "value": "8146f7d5331f7b21088d23abb8fd2ecabdc9d218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274315, "uuid": "0d87647e-fb39-4551-8330-3275dac614e7", "comment": "Malware payload (Mirai)", "value": "8fafbcbabe1ca4560157981b5102792874f234018326d67a4027a24a94682548ed3f5185b7d64d7f3cf1f97409f130c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274315, "uuid": "12ce8a44-f01d-49c6-b0ba-5d91986d704e", "value": "T121F2E6C1B8825A2BC2E423BABA6F558E336173A8D2CF7717D8111F107B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274315, "uuid": "e0f2cf28-be4f-41d9-a2c7-3f2f2f679ee6", "value": "768:Zrk9VXt7tq56tW0G0xayo1xC3jA/AuYzrUw/M9T:8X9to6do1eKuzrUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274315, "uuid": "d72202a1-45e8-40be-b9a0-a7105bbe4021", "value": 37128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274315, "uuid": "c993cbb8-bf33-48fa-8c03-666e0eed5acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274315, "uuid": "3a4854f2-e772-488a-bfdc-d9a61016d1b7", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a59c222-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "2ba7378f-77ae-4dd7-a998-123c2124d56d", "comment": "Malware payload (Mirai)", "value": "674e202e9e28574220041c90c4ffc55c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "53fea353-ce07-48ad-a70b-ae66b900dc61", "comment": "Malware payload (Mirai)", "value": "68f13ab488e209bae93f7c03b8c14a2f51fdc1930a8412dc806c07a58beeae73", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "664ed75f-cfa4-485a-a3a3-5b178e027577", "comment": "Malware payload (Mirai)", "value": "c6ca6711e0d7c52dfb95b7d38d40d4eec643287d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292329, "uuid": "fc9f06ee-31cc-4713-9731-9931616b3e11", "comment": "Malware payload (Mirai)", "value": "7173fb116667546d94320e158ed2b2ec3da25c2451ba8f3fbbb10401472ba5bd6c0ce2a0ac4c4de2de84449efb0f94cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "0e8fc015-de20-4efe-b181-29d4466f6e00", "value": "T12BB2E120E34551B0C4A5453EEF7A410932E21FF4D2E6322B1D484FA8C15ACAC91FAFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "a496f2af-7556-4049-8f5b-d11cfb062880", "value": "384:i/v2xOtCrv5iMlYxSJeTbcZNmA5nTosVhb4hxZxVGAQGmtX42aOtQEg5HMhymdGO:i/exOEd8x+e3Ewwsibofb+GmF42NAMse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292329, "uuid": "1fa646da-430f-4a8f-b6d1-a7939b54db65", "value": 24360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292329, "uuid": "093618de-fce3-4e3b-a4a0-4035f8556e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292329, "uuid": "06741668-463e-47a4-bbc8-380fd78315ea", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4e6b40-5df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780342719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342719, "uuid": "1579fed3-40bc-464c-b3fc-bce0cd045395", "comment": "Malware payload", "value": "50f56bf73b8c48c3bbb062100be26629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342719, "uuid": "876f9253-c0b8-4032-9157-7b7e5e63c04a", "comment": "Malware payload", "value": "693e28f619b0fd991846f608c6b4a10bf7d681b89bf5420a5f8788313beadc7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342719, "uuid": "b66a91cd-39de-43ce-ae81-d2d0f7a44f58", "comment": "Malware payload", "value": "0016f5964d0a598249285d1c13014e0f5f458a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342719, "uuid": "6cd0f837-8108-4e32-87ab-af0d1dc2d473", "comment": "Malware payload", "value": "529121829c4ecbf1cb61c3ed11e4519abf379c61995c21db56bb12cc6255a133f8f073d08fcd91dd886ee9fb29f8d8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342719, "uuid": "360829a4-f0af-4f0b-8c79-d68c959c49f9", "value": "T10CB73317F2C9E63DC26D2A3565B38250A53BB751B4B78C179AFC355CCF239801E3AA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342719, "uuid": "681fadb9-5e8d-4940-904f-4c17d99c2972", "value": "c008f130736bc3e79bdc6a8b9178b97c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342719, "uuid": "0df1e8d9-12af-4aa5-8d6a-ecf4ccc6c131", "value": "1572864:M7FYrYwR+LzI3Kbie3Mjx3tHRTQMaQeHijJ4:MmMwo/0/eIXTsC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780342719, "uuid": "c86478c5-caf3-4993-9c83-d3f49c49f029", "value": 51027218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780342719, "uuid": "dc435e76-4c77-480d-b7b9-88af5d3df85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342719, "uuid": "5901605a-68b7-46c1-91ca-95750c326a6b", "value": "iVCam_latest_revision_win32-x64_vers-v7.3.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c800379-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "c5ab5a11-2480-4d41-8bce-7e8d6218fafc", "comment": "Malware payload (Mirai)", "value": "b17bc1b53c81657f7452f76ecd8284f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "8e5bc554-af9b-4a18-91bd-adfb2f2b6dfc", "comment": "Malware payload (Mirai)", "value": "695a999ea432de428343c1723a484fa522c51f0163009cc8f9ce82079039a4cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "c745acea-447c-4f2e-8df4-cc9bb34ea91c", "comment": "Malware payload (Mirai)", "value": "0d86549327569b30b23c9ca47be11f7434020391", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "17ce70ec-94dc-4248-b801-8e28f945ace4", "comment": "Malware payload (Mirai)", "value": "a24d2ab9bedf08fb0e8e85f7fb1f406ddd478fa9fb97ccdb49e497bd1560ec36efbaaef9d1d7b7749ed85739c70e0a5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "3fd03f1a-cb68-4dbb-8a53-abfb6861bfa5", "value": "T15263E652FA819D51C9D938BAFA1F81DC3343072CC7FD3506DE11AB2165DF5AA4E3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "ae040d16-47d2-43f0-8bf5-738be78acd00", "value": "768:WbErN8djzdBKCyaoz9UuurnN5PDpHwD1GLtLbRdTzheqh40PH33hlb+ondTiSk2g:XrN8RGCVo9kpBdHwhinRAqXj+o6WB67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292896, "uuid": "0937c770-ca6c-4598-8e26-756867696f82", "value": 68924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292896, "uuid": "fa4e25eb-75d2-4951-bdcc-7cdceefd4eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "25a0cec9-8607-482a-bbca-bf3a811f563a", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d61c760-5db3-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780316117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316117, "uuid": "91d9e3d8-a61c-4df8-9dde-3d9b498178e0", "comment": "Malware payload (WannaCry)", "value": "44ce2fdf968db31c943bfc60c39a22c3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316117, "uuid": "b6aff8c1-b2e5-4f0f-9dd4-f2941acfbca2", "comment": "Malware payload (WannaCry)", "value": "6a1ea4e0cbb46c5ac158c7f589f1b5ecc22c3981712ebfd94784ae4094129925", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316117, "uuid": "4c04df52-5a71-48cc-9e04-53847d3785ed", "comment": "Malware payload (WannaCry)", "value": "3388c7f0defeffa8d4139577b3aabf38c9b8d913", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316117, "uuid": "323ceff0-5637-4dc1-905e-a82d9fd4c878", "comment": "Malware payload (WannaCry)", "value": "3d8e9c6069158947b927d2371ae1c30395f39641b5eb0df1978c9bf218b1dd9734bef73d429ca98e06cc9dff5658bd01", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316117, "uuid": "47ad2e6a-ed0a-4383-b750-6d2a1d72affd", "value": "T15B36235A7168A2BCD007667448F7C952F2B27C9A23B95B0FCF90856A0D13764BF64FC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316117, "uuid": "7b645280-e937-4746-9a34-5244c8ee750a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316117, "uuid": "2e194de4-33b6-468a-8277-28c9cf76cddc", "value": "49152:jnnnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA:DnDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316117, "uuid": "9917690f-c9ce-411e-bdc7-f631e13a7d1a", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316117, "uuid": "4dffa413-4ad1-4358-8102-492e9b8781b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316117, "uuid": "40187965-d28a-472e-a7c3-1205e9fd03de", "value": "6a1ea4e0cbb46c5ac158c7f589f1b5ecc22c3981712ebfd94784ae4094129925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e06825b-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292416, "uuid": "2bae5612-0f72-4702-b406-b706d9a34020", "comment": "Malware payload (Mirai)", "value": "f121afb6fa31731adc4ae7bee04d3e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292416, "uuid": "3c7e4249-4ccc-402a-b18b-b6b58e7f184a", "comment": "Malware payload (Mirai)", "value": "6a516873684a38621cd0fe045dc6cc07317b537f2e563d3a07b3b3dc311ccdae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292416, "uuid": "6f45f131-07cf-4d53-ab17-7aea24139d74", "comment": "Malware payload (Mirai)", "value": "4aeaca95761c6abcc2c414b2753f31515470d3d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292416, "uuid": "7d170a4b-a183-48c6-aac0-996797a228f0", "comment": "Malware payload (Mirai)", "value": "4a5b9d3351e8a032b8b51fe81e68731691704ab99acb722b955c8dccd710e5c029291381bcf00ac28a6e2efeb9745d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292416, "uuid": "3b9eecab-1197-4b6b-9b8f-3ba3017c0648", "value": "T1D4A34A02B35C0E13C1A34AB4253F67E587FEE9C121F4BA85290E8B5696B1E335489FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292416, "uuid": "7dd3579b-c878-4fd2-a532-0df8743604c2", "value": "1536:qOWQrpaTe5zCGoreYkFTYmqO2YPgzUqcRisdImhcK60f17:qOWgse5C5UBbqrY4qdItKv17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292416, "uuid": "266b18b7-4782-4ec6-aa1c-d8e49a7898d4", "value": 99744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292416, "uuid": "7ad1378c-493a-46cf-8fe6-881eb06aa090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292416, "uuid": "02c449fb-1524-4c6e-b1ee-04d33f0e07b1", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b023b1-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "11e09ba0-e3e4-4e24-a9e5-019671ec3877", "comment": "Malware payload (Mirai)", "value": "05af4a795d560b796fe8ac112adf97c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "dc124120-451c-4b63-aa9f-e420d92d034d", "comment": "Malware payload (Mirai)", "value": "6ac3d944353e917b957276c60f3b758c313c25e336eca58293fad0e48c2bb77b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "aa776b06-ef25-4444-a3ab-dc76b9de4880", "comment": "Malware payload (Mirai)", "value": "3112853c65d7aa2833b206849b66f31d2f646cfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "3580e762-cc8a-4a04-b161-7c61982d4cf5", "comment": "Malware payload (Mirai)", "value": "0f4835a7fe19a26edeec00e26063aeb0d9ab0ffeb6ac141ab34cc112332d51a25fe4f80122374aaf3fe92f9610ed28c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "5a18013c-9a00-46a9-b4ac-0452c165c025", "value": "T1BEA34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8FBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "e9a528c8-6129-4f11-927d-5fcc277dc5a0", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0offj:bbbmPTO930bkbRl886ffj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291512, "uuid": "71f362e2-336d-41a4-b58d-4e2ec71da84e", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291512, "uuid": "a9f57ed2-14c5-48d4-bcd2-b85bb6b2ebaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "5969eca9-7e9e-497d-a2cb-5886516fad06", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c7dc79-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780316824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316824, "uuid": "b763b05b-41cb-46f5-89b0-5d37f7eb1631", "comment": "Malware payload (MassLogger)", "value": "ebf18275c9a43ae98be5aa46791c06a6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316824, "uuid": "1ec4ec5d-9d47-48f9-b901-d68d37abb58b", "comment": "Malware payload (MassLogger)", "value": "6cb04df54a6342fcf8e89c132bd39dbb4a6150e9a66b162d900e1cf4d7f42189", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316824, "uuid": "d7c05edd-145f-479a-bcbe-af2a692c060e", "comment": "Malware payload (MassLogger)", "value": "b295c5277071d27f05006c7c63e6dc1fa97ea731", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316824, "uuid": "eb8084f7-c637-4b3c-a14c-a611c1d881cc", "comment": "Malware payload (MassLogger)", "value": "8eb4e2e2c1ab591b865fb4044206892605f822b586c67d18c99f55047ea2d1aaf7d60ccf99190af38ef75a650da99753", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316824, "uuid": "0f5c0f8b-cf3d-4d06-8606-ef42d80e739b", "value": "T1C8A54921CB96793497493E2BBB27883C6454D8135A23465F751A2EF10FCDE229CE6C3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316824, "uuid": "408b3fa6-f92c-4537-8b3f-65d7362bea0a", "value": "1536:di/iINLQdk8UW5c6VpojnlBAUNa43IVtyyCwu1S/VFNnjUinVsLPN6SO+Xf9+6+t:dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316824, "uuid": "7275e57f-02f2-4f36-b8fe-7e80e2613219", "value": 2095754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316824, "uuid": "185203f4-8772-42e9-9043-a70674cd4592", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316824, "uuid": "03531db8-4f3d-42e8-948e-a45d68a071ba", "value": "e-dekont.html.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a39a97-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780294274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294274, "uuid": "2e5de40e-06bb-4f6a-a096-edacfd7ec818", "comment": "Malware payload (ConnectWise)", "value": "de2c141b170c44a72810354722a0b659", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294274, "uuid": "b48a88ef-b171-43f8-9a91-5b3642b276a9", "comment": "Malware payload (ConnectWise)", "value": "6cc1bbe515410828551a1f8f8d35223d205cbd47472b284eb8ee3f39abb9b2a9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294274, "uuid": "1e4b8cb0-8afb-4b44-bb96-f1e0f292ff4d", "comment": "Malware payload (ConnectWise)", "value": "dd3d45d6da439e35387cc2bfdcaec31a9f590e51", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294274, "uuid": "9bb653e6-99fd-49e4-8620-29cc38f6d413", "comment": "Malware payload (ConnectWise)", "value": "f6eb58be823ab32cd5fdb8c91edb7458dc616b29c75f656cae608f229a2c2199285e69212c9049864f48200af249260a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294274, "uuid": "4af83974-6ebc-42ea-8253-c900331e7f27", "value": "T14C836C43B5D18876E9720E3118B1D9B4593F7E210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294274, "uuid": "18a0ff19-2ccc-441e-8272-dafb7976e38e", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294274, "uuid": "38932465-adf9-447c-a571-7e2ed1e291a5", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY/7/Jp:wenkyfPAwiMq0RqRfbaWZJYY/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780294274, "uuid": "e71e39aa-c682-4523-ad41-ece1b56aba7f", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780294274, "uuid": "01e8a0fd-8437-4ac5-aeec-d4e47fd06869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294274, "uuid": "850f86ad-fe21-4d10-8ce7-e53e07897029", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40021296-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277762, "uuid": "1ef89935-d822-4719-b8e8-e8d65362c84f", "comment": "Malware payload", "value": "6e6fc4151545b66fad2688ab46631236", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277762, "uuid": "486140db-d0e9-40ce-ba9c-8b2ca12ba55e", "comment": "Malware payload", "value": "6d340b1aa9934f229959a21e55c3a7cb6683164b228f4c7efdb1c0260321979f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277762, "uuid": "3e7acc57-d735-4bdd-831f-72cf1c81e63d", "comment": "Malware payload", "value": "93841e628a111ecf2d75278e4030d8ff66fd256f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277762, "uuid": "0a1633dd-d85b-47ce-a47a-5ffedcc14503", "comment": "Malware payload", "value": "d6b77fce0b8745b9127cec1f410f7cc105a98495491370424131421ce045cee46c22bc4b73022ac1c30b14f10446dd6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277762, "uuid": "38dd9340-970b-46f6-8ebe-dd159039161e", "value": "T12B920B2537EC9736EAB75F7CE5B5C12412329B81A402DF191DAC60DE45DAF818021BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277762, "uuid": "6845c945-3cfc-4d32-8f92-7fee0298b4bc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277762, "uuid": "8cf73166-58d5-429c-9bfd-08e7809560c4", "value": "192:e0jOLvJtwGJDb13LljWQp2p5XL2Iz+iTuyeSd1SQrtHZcVSQq+acmyv66cfjcRxH:f5L29wxzJt5cVUyBcLUEZsFoi+Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277762, "uuid": "44a82e08-69e0-4b1f-a0f4-fd277ddb8112", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277762, "uuid": "d2ad9b49-ee6d-4d99-a012-ab0b556b1667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277762, "uuid": "4ad8a8e1-b34a-41ef-bc59-e32cbaf8bdc6", "value": "6d340b1aa9934f229959a21e55c3a7cb6683164b228f4c7efdb1c0260321979f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668ac382-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293718, "uuid": "7ed829dc-e94c-4bf3-8e1f-c72d4e89cb8a", "comment": "Malware payload (Mirai)", "value": "5627fa7145e26bf3655f7b3bf58b8852", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293718, "uuid": "9a2f1f17-41bb-4522-9ba7-13ecb0d69fad", "comment": "Malware payload (Mirai)", "value": "6e622d4f1df916984ea79b0b50f4586e9bfca54bdcefd154849b6b10afdb1a8b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293718, "uuid": "8f79686a-ef85-4992-b282-ab91ace8d76b", "comment": "Malware payload (Mirai)", "value": "5547d0df4dfc8df5ab644b6df282f937a6c48509", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293718, "uuid": "955a4dd3-4bcc-4728-bee2-46ff45b1856f", "comment": "Malware payload (Mirai)", "value": "feba2e17fccae040f1bc446523510393e724c46cd3137bbf3792f9854ed818d883308d3c2623e5005010dbdb04fd9e38", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293718, "uuid": "0c00cdb9-ef5e-4099-8a46-fbca4fb368b2", "value": "T111932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293718, "uuid": "5b4623a3-70aa-42ad-b6db-4a818f4706a0", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs25:AGUJtkyYEETn0T32TDBf0nsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293718, "uuid": "2cb08cdd-6833-4254-9d50-8c16b1c0a17a", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293718, "uuid": "4f7fe85a-08c5-4877-b8f9-abb2e1490b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293718, "uuid": "d2c4990c-13a1-41c7-b457-9920fa1ba950", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf11f7d-5dcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780327362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327362, "uuid": "eda65b72-92f3-4c6b-bfee-57c1319543bd", "comment": "Malware payload", "value": "b64f0d4c3f0cfa371352f9c3c09b7209", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VT-cryxos", "colour": "#57327A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327362, "uuid": "27f78bd2-a997-40c9-8bf5-343b033ce64e", "comment": "Malware payload", "value": "6f6e3fb40572fac7381387c7da58a6f0af71bcdc50339d2324ea799d4b525aad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VT-cryxos", "colour": "#57327A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327362, "uuid": "f0e59be5-ac2c-4578-82bd-8751f4a594ef", "comment": "Malware payload", "value": "34eed3b7dc1cb5b1ce1a94912759a9f574da545e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VT-cryxos", "colour": "#57327A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327362, "uuid": "6d0879af-3890-4303-b08c-eb7fdd254946", "comment": "Malware payload", "value": "44c8cb0b536a932b36a2d105cbc97dd1f71ff9319e33d5a86418f8c84bbd7e80ffa19a579e0def833c882e5527a10b03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VT-cryxos", "colour": "#57327A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327362, "uuid": "71c09e69-351c-44d2-8e03-ca3991464000", "value": "T10CA41CA2E9B88477122F51E686607B9FF993D103DBC249E1B0FC962D2FC5C55662302F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327362, "uuid": "c810cc76-2e8a-4ebb-bb1c-27f447f2eea7", "value": "6144:yn4131fnbUguzVRFc+xPDIKo2x83CRxCwpaQnk6g+sSZk4Uxg:yn413+RFc9SkS6zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780327362, "uuid": "4a4f1e98-8933-4fc7-bec4-e8cbbf6d1bde", "value": 449374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780327362, "uuid": "56f661c4-a113-4106-ae29-f3e122055df6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327362, "uuid": "a7780d52-665e-4f0d-8a17-083874ff6cdb", "value": "6f6e3fb40572fac7381387c7da58a6f0af71bcdc50339d2324ea799d4b525aad.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8b7fc-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274262, "uuid": "1ec4be5d-787e-4b0e-8430-522015163e7c", "comment": "Malware payload (Mirai)", "value": "21f12bf5d34a029b46b649070f1faee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274262, "uuid": "0f2cce99-33dd-477a-9d9b-5a78b101a854", "comment": "Malware payload (Mirai)", "value": "6f92b8898bdfee56a7e79399efddb8b9475053edd7f5401567188268062f801e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274262, "uuid": "5f1b8a91-c230-4602-ad60-a50cf8bbe4a6", "comment": "Malware payload (Mirai)", "value": "f8063c464c9e20f04eb0c6726f77f87c1beb7ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274262, "uuid": "a3aed823-09f2-4346-a68d-34068bb9d148", "comment": "Malware payload (Mirai)", "value": "e0812f11633c4883aedc668c9bcea649b68e9a9b176c2363f543b026248c05f87dd585900669adea20cc889de04ade79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274262, "uuid": "2fecb747-3594-48e4-b247-756d0b5ea943", "value": "T17D735B22BA751D2BC4D4A87A22F30725F2F2479B25AC8A1A7D710D8DBF3165032477F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274262, "uuid": "215b1ecc-51dc-49a7-a4a4-8db8f6d52d49", "value": "1536:mQMSZZm4fVFd9BPzPJuHQ7jtEeCNM5UeWzQSkWtgWG:DpzHzHjmpN8UeIjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274262, "uuid": "4bd8411a-63b7-4e24-b290-fc965f8ea63d", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274262, "uuid": "b3aa4c45-f37f-4aca-a328-434ca4123c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274262, "uuid": "479cc479-9059-4d8b-a2ac-2a038e05f74a", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5efcec6-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312427, "uuid": "e6439460-9d2b-42f2-8415-525faedb9c8d", "comment": "Malware payload (Mirai)", "value": "849f395985414ba646dc78ee750ed89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312427, "uuid": "3a19ff77-1119-4011-a4de-9cc21b42b850", "comment": "Malware payload (Mirai)", "value": "71b24afdf8c4e0c5b9d43446643f5140a0e025694558a44f1c260e0d0dcaf8e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312427, "uuid": "95fa343b-2498-47f7-8050-9ea16c926fe3", "comment": "Malware payload (Mirai)", "value": "dcde30e1b7e861c84be99c7aeba48a0f6b5228d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312427, "uuid": "790a4f14-8449-403f-beb9-79a9a70fd9ac", "comment": "Malware payload (Mirai)", "value": "b540b720b4a1ebf556c6fe6593b02ec18d7a689417af9c60fe3e2db559d31da0da60f8d4cfc249bb25c44f060b9a92c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312427, "uuid": "4557b933-b523-4e42-86ad-e6a6b44a23a2", "value": "T1F3C3E70ABF110FFBD86FCD3706AD0B0625CC554A22A57B3A3674C928F54B65B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312427, "uuid": "8097b7aa-ba44-4a16-8f05-0816a3f6c3c8", "value": "1536:tvX/WZT5e6n/+Q9pKpasQBfHcETfRDQpZaRBqrZpHpwWLBNvk78kJ:tvPWZT5e6Zpr8EupD1g78k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312427, "uuid": "7d7f97c0-fafc-4655-8937-7d268aaf7c59", "value": 122272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312427, "uuid": "d918f5f4-e946-4335-9ca1-8641a40896d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312427, "uuid": "606a5c5a-d760-483f-bf2d-56671a0b5a4f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61d5172-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292993, "uuid": "46db4968-fafd-441a-ab1d-928b7aa6f755", "comment": "Malware payload (Mirai)", "value": "b828fd37f29f6e7fa320b2b52b0e559b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292993, "uuid": "2f017148-135f-4f1f-a6f0-0c5043e5c4b6", "comment": "Malware payload (Mirai)", "value": "7222eb48e86fe2cb1650f958c89db4016802ceefa401653e5738f0de68b61844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292993, "uuid": "f07929ba-9efe-4872-99f3-f4d7faba4cac", "comment": "Malware payload (Mirai)", "value": "77484d19c131ccbd1036238ce3c394beee941029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292993, "uuid": "58be4c9d-7981-4c6a-aeac-e19818eccdc2", "comment": "Malware payload (Mirai)", "value": "6a45f323c3d4cea4a7ff92feb6d634d7bcf5b0dd05b80a26f69e58f47eeef163440affc838353896eaa5632cd086877f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292993, "uuid": "87fe4501-7e14-4d5a-83f7-e41ff31cf207", "value": "T1AC73188678969A1AC6D0537BFA1E82CD3B2573CCE3CD7207CD119F6136CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292993, "uuid": "a09bfb78-2dfd-47f6-b705-705f94b8aa1e", "value": "1536:PVuza8aam2uLd70zA+3rWTKCdq5ZFPK6t:9UaZa80zbWGvP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292993, "uuid": "bd5b585e-1661-4a6a-8527-3ccb2baccbf5", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292993, "uuid": "e9ea3746-477c-44a8-a0c2-3cf3019dfafe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292993, "uuid": "3cc2999f-f754-4359-87e4-ef610826b55a", "value": "fvgbh.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dff1ee-5d4d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780272264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272264, "uuid": "2cb5b8be-17a4-4e3d-b38f-c737c206d030", "comment": "Malware payload (RemusStealer)", "value": "44fa21871050661a11ff7273718df01f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272264, "uuid": "458d0530-f0c5-4680-9f2f-0605d99351e8", "comment": "Malware payload (RemusStealer)", "value": "734964bb89eeda583ba0c4ffa36d1caf19b24f7c020f3c37be981f075c4fe5be", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272264, "uuid": "c5a818f6-b2fa-48b5-b89f-d980ab9db885", "comment": "Malware payload (RemusStealer)", "value": "daa10d058b2287c2f7f1fcd0ed8d9c423d598c38", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272264, "uuid": "b8d8c012-1cbb-4707-afbf-5978f2af973f", "comment": "Malware payload (RemusStealer)", "value": "0b30ae87cfe19eebc76a028c0e11e495cce3a3bd8e3488b213c6aa358dd962da87ef0f07c9ea39cb0e1e7e1d34b43269", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272264, "uuid": "2da008bc-8001-415d-9283-bad6d11bd400", "value": "T196342A6BD25331FCD652C07892266232B732B53D47399EF702A2C3359D21AC0AFB9975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272264, "uuid": "df6e74fd-b8d7-468b-82ac-0623eb1afd07", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272264, "uuid": "20336a96-0c26-4f68-a20f-34bded37fdaa", "value": "3072:oYBWrKIvx11uXZ6xCDtCFf/HeeT2kx68/2SHEKjy/iXekw79iGfN1Tn06K:jWms1hwkPOSHnjy/kK79i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780272264, "uuid": "a1715a77-2ea7-4eee-a827-fab293df9321", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780272264, "uuid": "5b625e20-d220-4502-9554-3012c0920d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272264, "uuid": "72c869d0-f436-4882-9c23-3619dad44c04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0270b4ea-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322327, "uuid": "e8ed6d9e-c872-47b0-940a-9a34c4f3477d", "comment": "Malware payload (Mirai)", "value": "43b5574c919c09143581b91146d70671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322327, "uuid": "43ead694-35f1-4236-ba7b-82e98dfc8575", "comment": "Malware payload (Mirai)", "value": "73b672c53979619a86ecec82ee943c126049c4027de295bdd0b47cd407f40630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322327, "uuid": "fe815411-8a9e-4fcc-8205-3c14d2d23f10", "comment": "Malware payload (Mirai)", "value": "1567e05e30d0733e9a68f1c528fd0a00c9183625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322327, "uuid": "4e317162-b8f1-4edd-b6f1-acac7bd1e8ec", "comment": "Malware payload (Mirai)", "value": "675cdf63f8f97260f81584e33c07d314f5a51e5dfaec8f9c2251ccbcce80253496f368be4e86294e5e29b1fb63a4cb14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322327, "uuid": "12df4a5c-d2c8-48b6-9b7d-b3e061c28d87", "value": "T12E03F1906E064CF2C9BC407E38FE4F552B114BD87CA2EC652A9E83C1BD56076B0E9DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322327, "uuid": "d284915c-5fae-4369-bdcb-2419e7a08baf", "value": "768:qPTXXKttbRw9dIkP7FsAHfAS6f+duo5RHaZnd9My2EazPdg5oPGJgGlzDpbuR1JE:arKttboekPp/tuorSd9v2E4gkyVJuRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322327, "uuid": "b311233a-fa3a-47ac-96cc-757ad073b874", "value": 41348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322327, "uuid": "e6326054-d2ad-4ac2-83cf-82da6fbdc743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322327, "uuid": "3e9f9043-5eff-4d35-bdb5-9cc94892bb89", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9210e1ee-5dac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780313119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313119, "uuid": "7f18e9d8-a38e-4353-b7f4-cc88896ca6ab", "comment": "Malware payload", "value": "a264fabfe5951d9223054d13f0908ac9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313119, "uuid": "5f41a141-5af7-464c-bb7f-9edf02d951ae", "comment": "Malware payload", "value": "7511c036fed79133a14710785d755292839f5a98ea87978fb50a272401041614", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313119, "uuid": "37d060eb-b711-48d3-90fb-dbddda85c24d", "comment": "Malware payload", "value": "de58418587dbd3b86ab9eb5e4adadcee715df6d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313119, "uuid": "6f3e0405-edf1-4309-87e4-cc108e2e56cf", "comment": "Malware payload", "value": "529aba1cc02606c259a655abfa9f4240d870bae27f1539ef83dc0200bc05486f80270729c2b31874d604df38a25716a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313119, "uuid": "dc1c45d0-2d32-426d-8f05-371865956d23", "value": "T1D39733ED98412055AB2F0D12AC3104FB0ADAC1CAFE24222A735F1E56439F7FDBDB4956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313119, "uuid": "f7b12adf-fb39-494e-99f0-cb7356b37610", "value": "786432:W3JXB3OH+uzpIRDjr5K1ZUgAhs8momubg8HMZURqiH3Pjp86:qRBW+uV09KcWEmubgheRjH/jpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780313119, "uuid": "b1ce2190-af0b-4f26-b52e-975fdc26c4b5", "value": 41269981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780313119, "uuid": "ad953628-281f-408c-9e93-697e93ce6892", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313119, "uuid": "8983ab4b-8f1c-403e-be9d-512d927dddf1", "value": "dingtalk_downloader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459ac740-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780291945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291945, "uuid": "8dfdd5f2-39b3-4137-9e1b-f78f7c017cb5", "comment": "Malware payload (ValleyRAT)", "value": "b7c1e7e170da96045d9c3064f3cf416b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291945, "uuid": "ed3f7a38-3935-4725-9a8b-c84884294f84", "comment": "Malware payload (ValleyRAT)", "value": "75720cb361eb1ec010439450d71b05809ff7e07d0a72d811ff330e4b3838e8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291945, "uuid": "aa5f55d2-d696-4679-a7ab-d6955b91d568", "comment": "Malware payload (ValleyRAT)", "value": "fa7c02164a9cd6118085f4a828eb6b3de6165dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291945, "uuid": "0be00906-6c71-461b-aa0c-89997be58460", "comment": "Malware payload (ValleyRAT)", "value": "9ff48d200fcf9a73ff865e2e1421eecccae32eec2dd7a27bf2580a8dd4fda03d6a90b1b6625e088ab77db83c23bae323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291945, "uuid": "7b97834e-8be8-4c12-80f9-4c548e6e3ec5", "value": "T13EF75016B6058D8AF4769278548B4FA0E372ECB18AB1933723B8772D2FFE34C5E91544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291945, "uuid": "90712c1f-6467-41e0-8e11-134043492a3c", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291945, "uuid": "12d921bd-d05d-4381-afb5-3cd93267970e", "value": "196608:5K7zgcx/RDhMea5LRN3fMArDr5nzFo5fMJP3p:0RRWLR9hrp4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291945, "uuid": "e4e1942c-3c69-4433-987e-880a1dbc41a9", "value": 72068904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291945, "uuid": "789e94dc-8b56-465a-a3fd-999616baed0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291945, "uuid": "67faa7aa-86b6-43d9-a05d-ef0d25c59ca7", "value": "zmh853563206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6e56d9-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780316978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316978, "uuid": "96b2a251-3ab7-4050-9b10-a81faba7c57d", "comment": "Malware payload (AgentTesla)", "value": "df718cc88fd3c87474f054a1b763a134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316978, "uuid": "fe725263-ff0d-415e-8d39-3e30c7644731", "comment": "Malware payload (AgentTesla)", "value": "7590a307a9cfbe88f7aea528b890bf8f1e8d81228ef06fd65ceb06ab758fe0ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316978, "uuid": "6204c6f3-5f0d-4dcc-8f16-7d10a868e361", "comment": "Malware payload (AgentTesla)", "value": "48d4a32edaed80a43d94940f75687abe9e9d8d70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316978, "uuid": "cdef905c-eaad-4d21-b708-5376fad67853", "comment": "Malware payload (AgentTesla)", "value": "f1df6e22561cd0a918c10a04c29f227fd5d2ae00a674dfc9a8aa7fae63a0d06b01d12d959c1d300a36d602922bd0466d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316978, "uuid": "1a863514-a005-43ab-a7cf-9b2588e7b892", "value": "T106E56D449970E105BBC2CF5A6932AAF4B14F29477E284660610FE1761DDFF93C0A29BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316978, "uuid": "5fca4abf-9e75-42b8-9672-1f7bff34ef82", "value": "98304:s/EBy/DVBt2+QrOvQ1havXbq156yFQ90SYOL8u+fCN33:VyLV/OOvQ1hoXu6ARSguPNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316978, "uuid": "5290b53e-98bf-462d-8b91-8be8cceb77f7", "value": 3212591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316978, "uuid": "8aaa8c6e-a874-40c3-a99f-294ea2b7bf96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316978, "uuid": "26b4f7ec-280e-4172-8d44-b545a3e31e40", "value": "Payment slip EDR4658.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4289a058-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "fe2bef7a-f6cf-4d36-a644-22c7b111d1f2", "comment": "Malware payload (Mirai)", "value": "e9602f5bf326c21322d33467c8d5bb80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "81032c3d-5123-4f4a-99ad-fbf56b4efa8e", "comment": "Malware payload (Mirai)", "value": "7604e262c725b15094afe05f5035d90cd2e3b5c0276ed6f015678f0d90da4411", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "eba0fb69-07d9-42ea-80cb-10b3b2b78628", "comment": "Malware payload (Mirai)", "value": "5a4378eee1c38ff6bbc856ceca00d1197f0ac7fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "5639a013-005c-4e36-b1ff-d2d5d808ce30", "comment": "Malware payload (Mirai)", "value": "53c4b849d1743a37e015f6005de9d6bfbba4dffcf0b85ecc3c03f1b6b2a614b418ea9aa9b638591a94ddbb1f61409a8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "b10d7422-dddd-4d6b-98b3-369666abdf6c", "value": "T1D6257B2EF2B2F1BCE007C03417DFCAA15525B07926312DBB37C49A353E6ADA15359B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "70782eac-9606-49da-9fee-603158ab6d8a", "value": "12288:Kia3oAbeNgvzRNwGdoHtMLi+CSegujoS89uUbHlTIXTkayQgLonHX:Kia3oceNgv/Bly8kUbHl0X2Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291510, "uuid": "98836a3a-1a70-45bb-bb8c-f74fb4f6ad59", "value": 981512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291510, "uuid": "23185204-79b5-4385-a897-de39ff865dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "928a2b4c-b38d-46ff-8147-cc12bb2b1dff", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a615166-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278155, "uuid": "ba011ceb-15fc-4bda-804c-667073a7edf5", "comment": "Malware payload (Mirai)", "value": "d4bd35fcfebb0cd88adae11d0abdc4d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278155, "uuid": "ca6bdf6e-20e9-43aa-9087-dcef88e554d5", "comment": "Malware payload (Mirai)", "value": "7652a218b032c6de17b3b0c88cef828a26f559982ff3e6bc11c3eebd1852b263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278155, "uuid": "4cb128ae-7671-4ece-a6af-8df478cdc51b", "comment": "Malware payload (Mirai)", "value": "fd4343dea7a5638c713238c87d67e63e3f0200e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278155, "uuid": "87572f66-51fc-4df6-ae89-ad25cb06bc10", "comment": "Malware payload (Mirai)", "value": "785e0c9a00a839173485b7dc745b9b879898350cf221ec98f7370b8b9ed75ec4d665377a1020bb468539e2aa3cf4212d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278155, "uuid": "d0857770-68e3-4ffb-a9a5-ff5df6ec23ec", "value": "T182A3850F3E554FBDFB6E873847B75E369245239626E2C140D15CE9001F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278155, "uuid": "4a156fe8-ea75-4672-9d8f-11ebb3746df6", "value": "1536:uoZm1d9O9hdZIzHcUhFtGyrBOevws8dR+DHxJFc5RNN79byVmmYvClDom5gsV:uoH9h079Oevw98mmYvClDd6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278155, "uuid": "5e733165-9062-4a48-90ea-c969d623dd55", "value": 99228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278155, "uuid": "4566da91-fa73-4eab-b1ab-ac54eb597f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278155, "uuid": "869d9bd4-96af-4ec6-b121-316d89032f8f", "value": "7652a218b032c6de17b3b0c88cef828a26f559982ff3e6bc11c3eebd1852b263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fb575e-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274257, "uuid": "47c3e510-5cfb-485c-b57c-bc1f43e5b025", "comment": "Malware payload (Mirai)", "value": "1bc77435eb183ec540d7f76e5cdf4d0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274257, "uuid": "6a3300e7-98c1-4fb9-92c1-13b66cc85a04", "comment": "Malware payload (Mirai)", "value": "76f92d7cb9b899cec2441565e006a1a34d1a3cde73aa51b8a01e30fb7e9e8c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274257, "uuid": "b4e15ec4-9ad1-46a5-8c0b-bb94ce4dcd44", "comment": "Malware payload (Mirai)", "value": "3044e266b1149e7335437afe48fb185e6e0075c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274257, "uuid": "8967b3ca-f813-4604-b9d7-576d260fbbec", "comment": "Malware payload (Mirai)", "value": "2d8abbdb5e86d9afe483f56d66787e90e6baf6e95b66b2efdd830c2789dd031e6c4b36957bbdc307cea22c364a25b4de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274257, "uuid": "0893a801-5261-4cb6-bb65-4bf86c127d36", "value": "T18D53AE77C8396E64D24581B0B8748E782B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274257, "uuid": "9a45e6ba-3c97-4953-907f-411370d93532", "value": "1536:caCwtuAPFqcgdEc05KU3AwHup+CSXHld5Zo:c58PMcgaNAUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274257, "uuid": "fefbe2b2-745b-41d9-8746-924e184e3228", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274257, "uuid": "73b02893-3e46-44e3-b954-413ae9f9f3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274257, "uuid": "66ca042e-f2d1-419e-949b-b674780ecd88", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ec0707-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "6b183fd3-3cfe-40b1-9fa6-99c544e7cb45", "comment": "Malware payload (Mirai)", "value": "99ebe819b29b3fc319ad105d65942879", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "619badcd-5b5d-491a-8c52-b3eb3765c5d6", "comment": "Malware payload (Mirai)", "value": "771e26ffa4f9f53449615d6efa310fa469cad503c0dcf6bcc3d243eed641eb95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "47a6721a-5019-4b50-a14e-d322723b3dda", "comment": "Malware payload (Mirai)", "value": "694f708a16156fc82ca0880dc3197504a9fb3381", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312399, "uuid": "b7f6da16-685a-4c1a-8159-4da64086ea0c", "comment": "Malware payload (Mirai)", "value": "1aef0c2e5a7564b9f200ad43aaac3ad25c418cbf8ee6cb203461085bb9a44a7e79c59027b5d9ae9ad78bd0adb2c1f915", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "ffa02576-b3c4-4922-869d-240893f473f1", "value": "T11BB2D1107186D7418B319071DFB8C38879922AF8D7DD32397A29DF81B29B41E537D94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "070357c8-d1bb-49e2-a63b-a4fcede30d14", "value": "768:5/BCTakh/ppzVaMfiStOij2M2SGTZl3Rw/veM9s3Uoz/kB:H2hZVaqzvj2R73m/vtAzMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312399, "uuid": "8829bb0b-8c4c-4939-ac40-84f3dc7c38c4", "value": 25588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312399, "uuid": "5b00ed13-38cc-43e9-921d-31ce8ad75fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312399, "uuid": "14ded01c-a519-4933-a813-f8c7e27a50ca", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a87afe8-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780294181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294181, "uuid": "cfa3bfb6-aea0-4dc6-9347-46c3f8ce0bba", "comment": "Malware payload", "value": "4bf338918525f83ead5c6ac204badd1d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294181, "uuid": "45da38ef-1f94-4266-a4d4-6f338b1a89b6", "comment": "Malware payload", "value": "7857a221d9ccc1d43c92a4aa44eba3f31eeccc291d95fcc17b395c6912f0c748", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294181, "uuid": "3170b27b-500b-476e-a697-f17d3708d1c7", "comment": "Malware payload", "value": "3e1969d3f959425704191914ef837a6f89d254b7", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294181, "uuid": "7e5d9bf1-43c2-4c59-b163-69cd4b80e8c6", "comment": "Malware payload", "value": "62977926fd902383a5054b45d849aa45f43faff0bf1c8826a470429248a837f98b53941434d644afd4db465aefd10d21", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294181, "uuid": "cf754541-89b5-48dd-a5ae-aa6a2bd24d56", "value": "T15524DF1599DB9AB0F42A60377F8C552292CD17F8597934866CEE34D6CF238B7E638C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294181, "uuid": "6ae04825-eba0-4a99-80e5-c64733b9d0dc", "value": "6144:9GRHFEW7BhQM62x/U5nWdvmmpXTNHVkuxqbgGMYk+BK:9GRp7BhBPekemXtqMq1MYLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780294181, "uuid": "c938e529-6b2b-46f7-9b6c-5121072bf4c4", "value": 224740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780294181, "uuid": "078959b2-31e1-40c2-99cf-c04757813520", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294181, "uuid": "9ea51574-b9e7-4c85-9b84-02e63120f1a4", "value": "RFQ #261474 Detailed Specification-2026-05-31.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264cfe09-5d4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780272995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272995, "uuid": "e2ade3f6-fd89-43d6-a51b-eb69f62b51a1", "comment": "Malware payload", "value": "9267e0e2908eb1bd4f07ebb5c7144e9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272995, "uuid": "32d968e9-5bd2-471b-ad65-8a73a9357b9a", "comment": "Malware payload", "value": "7860a9fc9615e5b82abe5819566e437ea61f4be2a29e128a61ec3fdb7fdccb07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272995, "uuid": "d195d9ec-cb38-4686-82a7-2c334caba9d0", "comment": "Malware payload", "value": "670bf53273465945ab69800d8e1fc7a4f0ccc909", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272995, "uuid": "ce74f7ba-5bde-4783-95a7-d07a50e8a8c2", "comment": "Malware payload", "value": "51334372f5ee5c491de6b33beec0d61de7f64816825b186750a4cf0200afd55fc7319da0280a415702bdb370c050960b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272995, "uuid": "c00d96d3-dc72-4bcf-a022-7e278c8cc293", "value": "T1F218CF1AB3950EE7E022D634CF3A8133DAB17C629134839E35C6F7055FBB6424E5AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272995, "uuid": "3142523d-ed63-4edb-a020-2c87867f0b06", "value": "d8a4cf06f95d79130965186f8db9060c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272995, "uuid": "a54d30fd-93c4-4fe4-adce-6cf715201a23", "value": "1572864:Mw4vBO3hDptfp68GVYnkah4BnnnnnFb6hq:p3ds8AaU6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780272995, "uuid": "f532639a-5f76-421f-bfd7-4f3c4b8e6aa0", "value": 92596224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780272995, "uuid": "a09d8da4-a78d-4109-ab4f-28cd6fca4262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272995, "uuid": "98a13243-a384-42d2-9bfd-28be8cbf76e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23832a1-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "7c4ebc71-830c-4886-89b2-69c47528b1dd", "comment": "Malware payload (Mirai)", "value": "ce969f7996a314a5664797b3d629e106", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "0fafc28d-e43f-4ef6-95fe-8412b25d0a17", "comment": "Malware payload (Mirai)", "value": "79c0055a9851f4ecadbcbbece4c8274603b866f846df5911d9e27d657140a53f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "c53a9806-533d-475b-b3b9-f52d09563a8a", "comment": "Malware payload (Mirai)", "value": "eda05101876cbc7dd4e26c0ccb69af5685249911", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292181, "uuid": "28c71948-fd4a-48cc-a726-5ad58a95a629", "comment": "Malware payload (Mirai)", "value": "70ea3a3420f8e846bf0ad69edc3d1ecad948508838fecc270ee18cf215b286ee10d8d2af246e1ca6b05f623dcd39a8bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "4f43ad7d-d5d8-42dd-8d1c-5e9a6aa5d058", "value": "T19FA34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "d824b4ec-284d-4caf-be28-fc603d4376fc", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oZj:bbbmPTO930bkbRl886Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292181, "uuid": "32802207-d3cd-478c-ac11-4b7024402027", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292181, "uuid": "6a6963e3-9109-417a-8dd4-be6eb0d5e05d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292181, "uuid": "26b339bb-2358-4e13-b189-4f09c2ae48a1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6b32b3-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292282, "uuid": "b297bee3-6444-49db-b6f5-231c263255da", "comment": "Malware payload (Mirai)", "value": "db72f5e0d507c0abfcf9d6ff046cdd14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292282, "uuid": "f9d2a389-4698-4ecd-9359-5d4f3e940d9b", "comment": "Malware payload (Mirai)", "value": "79dfad940aa718395f04c71d5eb99fe87f2072ca1ce4d534c0e1847631f1375e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292282, "uuid": "b6b0b36f-c802-492b-92ae-625d264e449f", "comment": "Malware payload (Mirai)", "value": "50ce4f78161c4a670c0cbfbee6aa2c0b5c1bb5f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292282, "uuid": "5d7f2443-4b8f-41f6-aab8-1391d374b75c", "comment": "Malware payload (Mirai)", "value": "6df3c6f4c41924a0a38359cb30f95e7728b72ca366912dd616c122ff0b5c0705a4d0c39ca40c8b1d3e204c1f9301d98f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292282, "uuid": "272efed0-7c46-4807-9c36-d40ab00da43b", "value": "T10C51B4C542866C3968B7EA13F6B68138308191D318FE7F9ADED8BAF0868ED347140753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292282, "uuid": "5c5076ab-1ebc-4603-9531-591cbb2ca89e", "value": "48:ipl70l7N7hplvl6GplgnlzPplflKWpl1loUpl71l7o7UplfOl3bplEl9RplhlcgN:iD7Y7N7hD96GDglzPDtKWDvoUD7v7o7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292282, "uuid": "483ebf0d-c024-42fd-903a-8eb4a14e242e", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292282, "uuid": "3f6c8afe-d5cd-4665-982b-43a37f3f73a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292282, "uuid": "70408631-85ba-49a0-bad4-b110e4a550a3", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65c128e-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "7257cd57-ae57-417c-8c54-e7f48ae2fecd", "comment": "Malware payload (Mirai)", "value": "ef5344d1ce83e656985a366868915541", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "c4346fee-ac76-4022-a627-336adf0c7b59", "comment": "Malware payload (Mirai)", "value": "7a6e634a6e1d59ea5fd15d843cd70b6c69fe263f61d25c46e3e5b46c5e1b0d00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "2277b988-c9f9-4995-aaff-f28a68f131e6", "comment": "Malware payload (Mirai)", "value": "e64f1b58ebc51b092fe072a64efccb36c24174de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "476700df-ebec-4f82-8d95-12374f65f17f", "comment": "Malware payload (Mirai)", "value": "64a819e05b3ca280b96ff471e346cdf3afa448220f55c3df1f6fc5cab08454610b27ce40fa5d41e7b8ef170c8f0d0c7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "7b67d1e4-2a90-4eed-a192-2907242da359", "value": "T16113E10B61A58B24E0F811BE000F3D4D0F6AE1D688A6456767D471637C976367E2EB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "ba2faed6-5a30-4295-8204-4f6ef41b8faf", "value": "768:Q7lMBJB34XAKVvLKCdo86Q18keL+ycYL/k5nbcuyD7UHQRjj:Qo73X8vWCdGQ1q+ycYL/k5nouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312401, "uuid": "00e4a505-99ea-47cf-9e6b-8c2f0e8771c4", "value": 41772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312401, "uuid": "7e9c8c8a-2f43-4780-926d-a7795ea71f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "b17c868a-3074-489b-9c95-10910e512cde", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8be6504-5da4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780309721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309721, "uuid": "23b70f3d-2c7c-4e1e-9399-52c6b41ead60", "comment": "Malware payload", "value": "cb90042037552d8912601ea5cf1d1e89", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309721, "uuid": "220a5a5e-c059-4eaa-ad0d-20fde1ada23c", "comment": "Malware payload", "value": "7af6744b367a0cbb6a49c38954b7a691613513907aff6035594141f56aaf297c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309721, "uuid": "9f65ab6d-8e6c-488b-a4b3-8e36ed165ddc", "comment": "Malware payload", "value": "7c7782ab905cc6d3dcfa1c97f8fae796f650680c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309721, "uuid": "48bfdd07-5ffb-4da6-980d-ea901ba1330c", "comment": "Malware payload", "value": "a9e9356f756ead87b8af7cd329350dc7ef99e5db4c6115def249605a8c29e8dd2aa643f3d21e94fb24d13eae1a4dcf40", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309721, "uuid": "2134c5ba-a120-40de-bc25-1b24216c06fd", "value": "T1A6D6013BB14F652EEC6ADE366572D110583B6E61E4127C36A6E0B84CCB353B01D2E64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309721, "uuid": "9501599f-4912-4ca4-841a-aafa26526b49", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309721, "uuid": "2b479607-26ac-4f11-a175-ce4a7d1d916b", "value": "98304:j5/7txRAGURyUJhtfXqB5tUzHEPMCZDitAsxAOz1TEVi0beKwa+V1eX0e9lm:9Je4UJHXEvUzHEkCgAcVpTki0S7HsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780309721, "uuid": "54722270-ecdf-4e52-bc6c-8e20392b3e45", "value": 13402173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780309721, "uuid": "f53f8768-1794-4ca5-b50b-94974c3016e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309721, "uuid": "1c7b6529-81a9-43ef-8284-78d54f423bad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1f3243-5de2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780336171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336171, "uuid": "71e89174-c93c-40e8-b5d0-ab3311ef6d90", "comment": "Malware payload", "value": "8457e1d3105385fa9211884bd8f0e9e0", "object_relation": "md5", "Tag": [ { "name": "85-121-148-62", "colour": "#8D4D71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336171, "uuid": "11238ed0-01c3-4aa9-8857-e610d2403bc4", "comment": "Malware payload", "value": "7b1f58ca49b7079e6b100bba60cb9a2be051496b77e2978228ec2cb71721f4aa", "object_relation": "sha256", "Tag": [ { "name": "85-121-148-62", "colour": "#8D4D71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336171, "uuid": "bbda6435-ed7a-4a7e-a81e-1c040cfc42c7", "comment": "Malware payload", "value": "6acb8b77b9affd0c5b6424c3f55b313e098ce86e", "object_relation": "sha1", "Tag": [ { "name": "85-121-148-62", "colour": "#8D4D71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336171, "uuid": "fa81b56f-475f-4d22-8955-a67ba16158e4", "comment": "Malware payload", "value": "4b6240a03ddc72873c3436b7d68be1f040d41a39393a2c8d6e1581952981b9d53f56015d0be658b0fe8616a434f17c3c", "object_relation": "sha3-384", "Tag": [ { "name": "85-121-148-62", "colour": "#8D4D71", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336171, "uuid": "8167cef4-fe12-4f48-88bf-b1e85f61303e", "value": "T1A675D607EBB651E0D8FAD0399656722BBC71385983349BD797809B474B62BF0E93E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336171, "uuid": "1453b2f8-0ad7-496d-891c-bc2883b6d058", "value": "26adeff43ed8b0c860a1f33385d8a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336171, "uuid": "b0ae7551-ea8c-4bb2-92c1-cd2d847d2bbb", "value": "24576:n2aESGkBkxv2xL6uBfEoAGTDa8F9h5lJBbguZh5vb4fptGqo8:2K4bia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780336171, "uuid": "972f4e1a-f4d6-4d71-ab1a-8b6363e8556b", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780336171, "uuid": "f5257613-5e04-45ea-a06a-a3ac89e3a502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336171, "uuid": "9e6741da-9523-4181-b431-7e3c02ce77ed", "value": "911Implant.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919cb4c-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322391, "uuid": "409e744f-7a78-44d7-adac-a9ac79c1d3c3", "comment": "Malware payload (Mirai)", "value": "7a388b12e34b7f7d012390bd5d84f461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322391, "uuid": "8a4a830f-3b20-45a2-b96e-c7bf23d613be", "comment": "Malware payload (Mirai)", "value": "7b29120ae10a54cb040e63df8571f53bd05b4a89e3ad3aeb6fcf572878c3d928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322391, "uuid": "c3e9e726-b2e0-4e1f-a236-cd46837dc420", "comment": "Malware payload (Mirai)", "value": "6d72413f3dfc122a612d9b56d879d9a90e0a7411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322391, "uuid": "68eb16a6-6a8e-4d83-953e-4773ee997272", "comment": "Malware payload (Mirai)", "value": "d458f7579c49c7d6219d9acee170bcf110e883744061dd1ff978dcc919d0a3a6c38373ad2157b1ec1951559e9a3fe44e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322391, "uuid": "61b01c74-df22-487e-bdf7-18590ebbbe06", "value": "T170735C8AF6C3D9B6F8520C7510BAAF735E73E5BE2174DA43D3B8B431E812102E506A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322391, "uuid": "5253dd54-deae-495e-b562-7f0f78fb9b76", "value": "1536:eDWNYlriwjtf36S5vlRFEMTynG94e523GSka:eDnlrftfP5NRnTOO4Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322391, "uuid": "81051d0b-ce03-4598-8163-573f2382c491", "value": 78932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322391, "uuid": "155a6227-c17c-431a-a036-b9e906046800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322391, "uuid": "c965e61a-9da6-4c06-a529-8535f8f6ae0f", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f448cd-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292395, "uuid": "e1cfb88b-a5b8-4eae-906a-d27da644c954", "comment": "Malware payload (Mirai)", "value": "17590e7491122c0a77bf7ca35f6032e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292395, "uuid": "0d2edd22-3ecb-4741-8595-9528fa77fe7c", "comment": "Malware payload (Mirai)", "value": "7c41f8f46c89e1b7cfb72f737ca2af22b3a9f263815b6bfc0500d997cdb4d4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292395, "uuid": "a83c036e-d1b8-44c0-8300-6a000cbea2ff", "comment": "Malware payload (Mirai)", "value": "13e5f5bd798539d6e204048ae89e3b0ef7696295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292395, "uuid": "44b11740-c2a5-4c8b-b232-de46c023d2e5", "comment": "Malware payload (Mirai)", "value": "83c23ca4c9ffbaf57fde4183f70429c5f3b7e98d22a8a09201fd73e8d5b85e3ca917276dfe55d751abc77303f20832c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292395, "uuid": "d9b66936-fc2e-458b-ad08-63c7dfb0b774", "value": "T18B045C46EA414F13C0D6177AB7AF42493322A7A5D3DB73069928AFB43FC275E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292395, "uuid": "b52f7818-aab3-4506-8c22-392c1d27b966", "value": "3072:XIDnSV5J1q4VKDeeLazo0ZwqK/T8T4JLMZHJ7ChKdeM/9+f6sf:XWnSV5J1q4VKfLazo0ZwqKr8TRJ7ChtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292395, "uuid": "b1902de4-a187-4e0c-b404-bc8c0eb2097d", "value": 186243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292395, "uuid": "1ff69cf2-8ea7-42b2-9a84-529ac759ea0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292395, "uuid": "22de610c-2c8f-4ecb-92b5-71488ff7bb7f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1699ea-5da9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780311765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311765, "uuid": "597a03dd-7018-4b77-8258-b7672543bfbe", "comment": "Malware payload (RemcosRAT)", "value": "438b972cd69c826e66f4f99a77a1626e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311765, "uuid": "20274c21-2cda-4bcf-bdd4-7e2e21ee350a", "comment": "Malware payload (RemcosRAT)", "value": "7d09f18a36d4e707adb6afe694da50140455a1d2f2d371615687f2241bf1e7c4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311765, "uuid": "900574ec-6328-4cc0-aa50-8a4b93bb7802", "comment": "Malware payload (RemcosRAT)", "value": "38538908d6399bb00fdf78336a1787b3bd2425eb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311765, "uuid": "f660dfc3-a242-42d8-9d1d-6ebe39f549ae", "comment": "Malware payload (RemcosRAT)", "value": "f4d208af514614d4a871ca6d2cbebf3ba0f1d725fd41b53541837ad5335b4653d6ba2aa26c531ea0b222c7fda4e191e1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311765, "uuid": "87e4956f-1e62-48fd-96ed-3d6e96a8e2de", "value": "T1F3A46C7AF198C8CEEF6782B1A7674940030E9D683B595621742E7A36F5B3E5CCBC3046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311765, "uuid": "919be82d-1a62-41d4-a303-4c6acf424ef4", "value": "6144:Bh8izM1ozwIK91mf5GDoB9g7JK5DEHYz7J:Bh8oGgcIw02JIE4z7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311765, "uuid": "55458cda-1c82-4543-90aa-d761bbf307d0", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311765, "uuid": "6debdbae-2875-4fc5-a928-e48d338b9296", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311765, "uuid": "4cc66e29-4e9d-4a45-b048-8f95c3ee9424", "value": "OrdenXNo.X5700080331.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fcd81f-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292930, "uuid": "f47dc887-128a-498e-a41a-091c00688451", "comment": "Malware payload (Mirai)", "value": "bbe98f7f2bae1d1e9b1afc7077c076da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292930, "uuid": "9a97e9ee-7c02-47c2-9826-5bbb587808c1", "comment": "Malware payload (Mirai)", "value": "7d60199e346ab93c86d2bacc18877ea1b3108acc63c32ad533c7c1b5e6f6b0d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292930, "uuid": "73204b40-e972-4952-8b09-af76ea49494f", "comment": "Malware payload (Mirai)", "value": "001075d74891c5027185b2657eae8ba0f665b45e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292930, "uuid": "144a0131-d109-4b72-9106-c5d743cd668b", "comment": "Malware payload (Mirai)", "value": "28dfce9e13f22a8b76ba676f1e940024d254ee8ce6e826d6d624d7895ec3084d0c0d76ece2d8b57fbe046ea977bce2ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292930, "uuid": "1e25e730-2b06-4e29-8eb2-a398f1139037", "value": "T1BAA3C846BE04FFABC03D4F70AA69CB0210D4A5C5B6A5A13F72A097CDBE792131E435D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292930, "uuid": "9bb0e451-e7ce-44bb-b0ab-df3ea65e5949", "value": "1536:5jir5ojUYLuWQ0nOgs6fo9ECS2Fh1fhXWh7hqBIM62q3+Okl4K3:5jaCjPLuQOg491xU7kk2q3+X4K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292930, "uuid": "48573679-02dc-4969-81d3-a62e9420b1a5", "value": 101272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292930, "uuid": "dc25aa2d-6b8a-4eb1-aff8-ed2b7a8901ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292930, "uuid": "29378191-694a-4385-a96e-a0dba6d042a9", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20611c68-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346858, "uuid": "f5a38887-fa0b-498c-9a43-702b9ef0a7df", "comment": "Malware payload", "value": "380c3d0d1aa75541c7208c39c085961e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346858, "uuid": "99a82d41-b350-420e-809e-9d5c348029ad", "comment": "Malware payload", "value": "7d7cb34386b8b64fb6b62d01f38a174915b553eccc4d1e77f74b537b1af54f0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346858, "uuid": "035938f8-fef8-4967-9432-3c33b838b55a", "comment": "Malware payload", "value": "d07e056f25932d686f2503b54fdf41cbcaefb6bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346858, "uuid": "a89afee8-68bd-49fd-9a16-ba24f68abb53", "comment": "Malware payload", "value": "4a13d5f55ca650717667b12c307ec03117a5429f66db94a0b64fa12845336246b7b7545b0623575bb11b041b1a611b0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346858, "uuid": "2641abc2-87ec-417f-9e6d-95152bf9c6b6", "value": "T18C23028A67597D33DEA2B434E43411CB2FE92EFA01FB329507B3097D286241A2DB9517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346858, "uuid": "1cb60350-33e4-4ce6-b56e-c4162a1837fa", "value": "768:Cz8nS4FLJAcQGDSXf57MPKfydM9cMq9vfsGeJGhHfUoT4YzaDe9q3UELC:C7oLJJQG+f57MSKyY9vkGeJGhMotzaDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346858, "uuid": "770c95bc-27a7-418c-9703-16effe18c2c9", "value": 48204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346858, "uuid": "43238e91-e3be-493f-868f-96f770ebaa83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346858, "uuid": "1b77167e-bebd-4ee5-ba5b-ea868468d24e", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a393c78d-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297686, "uuid": "b32e20e4-9171-4026-8b45-8fc14b1c2ffa", "comment": "Malware payload (ConnectWise)", "value": "c42058c54748e64f4b4eeebdc325ac53", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297686, "uuid": "10979810-da0a-4ce0-9727-a3844dd6ff5a", "comment": "Malware payload (ConnectWise)", "value": "7db34a5b11ec3991a9a59e705f7a228cb2ab73d042b7e788eedebbd6ab5ce1f8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297686, "uuid": "b61e6ca4-7064-4036-9c95-eb930cdd9a28", "comment": "Malware payload (ConnectWise)", "value": "7c39b59d7633388e40134af7f7717ae8fc16a047", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297686, "uuid": "3e39068a-9b56-40b1-bf85-bbae94e99520", "comment": "Malware payload (ConnectWise)", "value": "48f069349b29d63abce8aec07cefdade8084700b2b71d5601c8725bc6761505963e8d83b580d2ae547e57bcea6f99cac", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297686, "uuid": "d5c56bc5-6911-4879-a567-f98fef91fe78", "value": "T12D646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297686, "uuid": "3a63294d-8b85-456c-bbfb-0d3d35fbae18", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297686, "uuid": "b0821529-7d38-4f2d-8a50-ae1e85356866", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297686, "uuid": "8b3325bd-24bf-4964-9560-cc7ba801a95b", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297686, "uuid": "dba52324-d9a2-4d08-8bf6-3493c9f8c333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297686, "uuid": "de0c791c-e05e-4132-82af-95751eda1a82", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a1a602-5d6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780286791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286791, "uuid": "8e7a547f-8597-4e1d-8c87-aaa9b5ae1680", "comment": "Malware payload", "value": "fd8af2bc5cbb2fe867245b24d8ded54c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286791, "uuid": "a904cf6b-b69a-4d84-b09e-a6ba2ea8a1e7", "comment": "Malware payload", "value": "7e3efb158688dc0031a95abdb628992bc3785e87c63ba8bc900055f2bef9fe6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286791, "uuid": "565d523e-74c5-49d6-9186-be8f539f2df3", "comment": "Malware payload", "value": "f7f9bb2ccdef65a43d9f1cc72e28ba8a24c56389", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780286791, "uuid": "85365d81-85f9-4782-b9a3-50b3f5484f19", "comment": "Malware payload", "value": "68f55da0e6caba062ef184fe003912f1ce462a1671b094896fe7ed64d47878dafa1fd6e48aaced9fdf5c0fe5d1360476", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286791, "uuid": "4f98f36b-5721-4d32-bd68-89caa2cb3f49", "value": "T1750733B3D65FCA35EE6759B395C24241247F21E0EC0B607D27E48E878A63C8B53A4B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286791, "uuid": "cdeb67b2-34f2-446d-97e6-1d4c4d7bfa0d", "value": "393216:/EWcjVDzJLsyUptepuC/SpNKt5MaAF3Dm8WD24Ux411u:/EWyWXns+KBAliZNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780286791, "uuid": "989d4378-6ca3-4307-b458-1f89413e5eca", "value": 17518178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780286791, "uuid": "3f0c4566-16f2-4472-95f8-eb2b7a95d97c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780286791, "uuid": "fe90c70d-91b1-411a-95f2-722e3c68d8a9", "value": "salams.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f347e0de-5df3-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1780343776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343776, "uuid": "f4d2ff5a-e5c2-4c5b-a3cb-c1b9eb444d84", "comment": "Malware payload (CobaltStrike)", "value": "20bc8a20276075a5bd7e97e2c2e903c0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343776, "uuid": "31e09ac8-c432-4bd1-9d45-c47085b9ba04", "comment": "Malware payload (CobaltStrike)", "value": "7ea8c0bb8ab8c412f289bacc5d4a8eeb9ddf60457ed1bf73f83c39a4483039fd", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343776, "uuid": "de3a24d3-1e34-46bc-bb74-7834993edc3b", "comment": "Malware payload (CobaltStrike)", "value": "35cd8723cf969f67e82224d965d723b1e5328364", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343776, "uuid": "82764e10-c361-44c8-bcc0-4cf411c4ef96", "comment": "Malware payload (CobaltStrike)", "value": "187fd3d05cee649a98f27c6d8b136d1d4160426560a024ab59f9cdad29153486a6c2c9f861b26a19c3ab09bedc95c4ba", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343776, "uuid": "1c70192e-3ce2-4a18-bb4e-cde2fed41242", "value": "T10E762213BCB04A21C74FDEB1143A876D0AE8AE2C093615D2E275B12DEFF11C15A67BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343776, "uuid": "c9fa60fb-b102-4cbe-80ea-b79716c3a3b5", "value": "196608:pye/8bZew3mA7snR0JLcChOv8t8lJK5hYbwiyAxFeb84:98b73tsnWJLcqltL5abwtml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780343776, "uuid": "b3158b8a-8f59-410f-800b-e8246628f5fe", "value": 7610368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780343776, "uuid": "847a9bfa-25f4-4152-abef-6cba053f1917", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343776, "uuid": "a0fda435-71e8-49e8-a85d-031b81301f6c", "value": "Onyx_Access.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dcb915-5da5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780310092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310092, "uuid": "26d37dbf-846f-4770-b756-65f570138114", "comment": "Malware payload (Mirai)", "value": "7510dad0680b1675079fb99e6b438e89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310092, "uuid": "40851ed4-28cf-453d-a0aa-93cb880d70ff", "comment": "Malware payload (Mirai)", "value": "82c4db2c55bca8b4a99ce22b0c340f2c03fd146df69bb642f65092bd4f544d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310092, "uuid": "6cd9bb64-392a-4685-981e-5e99491ae40f", "comment": "Malware payload (Mirai)", "value": "8aa8c69579575258c0b4a7f21d17b5e496e85a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310092, "uuid": "6bfdabcc-38a6-4e67-9536-070c341b615c", "comment": "Malware payload (Mirai)", "value": "400a29eabc2327ac263ea4dcdd8b64e0074db9205111ed42e03957594afdc118a09f0c4f31fb30777993f71dc3442dd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310092, "uuid": "3c0dd638-e9df-4e46-a4f8-cb06e17d95a3", "value": "T1926312296E2CA675C07DB5F0827CCD8F752621B47EA72E970F41A50032EB56E0F6A3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310092, "uuid": "b714debe-c87b-40da-bbf0-d47e8c901692", "value": "1536:TVT5PwXpdPHv71GHTwtji1Xkv36xAg1Lbtl85O2xuFtUyTf:TV16izwpgXUKhLpl4JIFOyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780310092, "uuid": "916ab839-db96-4aef-9476-83a30c612488", "value": 68720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780310092, "uuid": "60258685-659d-470f-bd82-3b374e6358df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310092, "uuid": "cf009484-ed52-4456-8cc4-7f27b079d57d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e025d5b9-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "8002cb76-5cf1-44b4-a23c-2b1b387ae8d0", "comment": "Malware payload (Mirai)", "value": "5416c9e405fc5f6d5db8ac8e65f273fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "9008728f-cadc-4e30-886b-a0272786cf72", "comment": "Malware payload (Mirai)", "value": "834cb02d22c345b571d87dd5d7f7b4cd8950a304545566ec11260558538cb2da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "a44b697d-81b5-4516-a212-7da7fceba16f", "comment": "Malware payload (Mirai)", "value": "45e4e03673e134bdde34a8ce70039fa3960153d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323558, "uuid": "89e51902-3b93-4bd9-9ee5-fdef57375d3f", "comment": "Malware payload (Mirai)", "value": "2f96e1a19c1d7e053e66811633b255a367e67ad20d24edfd6f9170d6a368fafb542e9668a06f2d03ff378898ff706258", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "4664060e-8798-4421-a467-83f16d37681b", "value": "T10E261957B8918683C4E4267AACBEC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "1d573eaf-adf0-4aa9-bcdd-ca2639510875", "value": "49152:B21nWdSgfEvwAOaMlXhf49hkiAAQaU1F1:BwnWgg6OaMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323558, "uuid": "5d278b3e-766c-47c1-a87c-e6dea0b2fe6b", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323558, "uuid": "6b2f4786-a7b2-431b-aa68-8e62ed9ebb08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323558, "uuid": "b77f2cdb-6996-458f-ae1e-3f3f4be55f4a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c608d8-5df4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780344096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780344096, "uuid": "0c33b063-2814-4fba-a07d-a3dbd479a38e", "comment": "Malware payload", "value": "e5c03bedc99d7b20f5196b6459f0b334", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780344096, "uuid": "5f6e6259-c34d-4428-b9c9-4ddb59324797", "comment": "Malware payload", "value": "84447200aef49356af5e776b95fec129f293d83e7b5f7e8c3e88e1d15f49fea9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780344096, "uuid": "d6ebddf7-953b-4875-8a3a-a1ebfc8c3a47", "comment": "Malware payload", "value": "248c69e896d18e5ec5a970be0835f19ce8bf59f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780344096, "uuid": "1789568b-f2b8-4c0d-818f-ce5aade27a47", "comment": "Malware payload", "value": "bdf4ef304e10b2c60cf2b858e37ce0ee5caf5329ba40b0f87082bbdc4bee01eccaab436cd4059d6b5ed1e1487c980d65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780344096, "uuid": "ef8da6bd-05c4-4e5e-b36b-5cb3371029c8", "value": "T1C2E544E5158A15BBC3B41A30CA2F49C57F7A01731439E14CF390C6857A8ABEE58BB9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780344096, "uuid": "b9cd2706-277a-489d-94fc-e313f955a782", "value": "12288:QISWV97NgmlWqeapPJ1vjqsQDZCdpqbydUvqg8UfmWk10+NCSp1:QevgmlWqeapPJ1vhQDAdtUvqg8UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780344096, "uuid": "e4141711-5fa2-4a70-b871-a6e2a27ad850", "value": 3314023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780344096, "uuid": "63142636-978b-4f37-b85e-2ce37e6f3016", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780344096, "uuid": "6f7e6ffe-bf14-4bef-811e-206d36fccd06", "value": "\u0417\u0430\u043f\u0438\u0442 \u0421\u0411\u0423 \u0449\u043e\u0434\u043e \u043d\u0430\u0434\u0430\u043d\u043d\u044f \u0456\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0456\u0457 \u2116843.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c0365b-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "a467fa48-9a8c-45c2-95b6-a62e250a4751", "comment": "Malware payload (Mirai)", "value": "0ffa1094ea63f66c2391d78610ba1879", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "e378f6ec-5089-4210-9b83-80773de313a2", "comment": "Malware payload (Mirai)", "value": "846cb3cf92fd078cc05903d644c8970a781282348a8fc9ac00c6265475fe8ac3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "c72cb24c-7523-463b-81fd-5325e9a7cd5f", "comment": "Malware payload (Mirai)", "value": "e436c4e0fef1769bf7dd7c4eb7cf98af7b8e0e62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293719, "uuid": "cae68334-b9a3-438e-9c18-9eaba7233a7b", "comment": "Malware payload (Mirai)", "value": "160b640c2198a146c480866ab1322d6eeb88aa0dcdb392c49b858336c72c66c7ee61cb0a89680d408579b5ad9eedb9de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "0c1d5555-0e40-475d-8907-c27faaf0d821", "value": "T193933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "3d9ae772-8780-4657-925c-e7e56f8ebb90", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2Dp:eyxt7W+G+3QBBntmzg6d7WidDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293719, "uuid": "c72fafb8-9b69-443c-9aeb-f8453c25cd7f", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293719, "uuid": "d05ae90c-cd03-441c-810c-5419051fc9f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293719, "uuid": "684f1bd5-8ec9-4404-a08f-59d6d5cfd5ce", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d6d53c-5dcb-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1780326382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780326382, "uuid": "ef939739-22b0-43c4-b879-a1285f11e85c", "comment": "Malware payload (KongTuke)", "value": "e44096b5c7a430bdd714412a237d6e9b", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780326382, "uuid": "b6b64b8b-5cd3-448d-807b-64dbf1265b74", "comment": "Malware payload (KongTuke)", "value": "84cccaa51f3eda07ed873476a3bb28b5e168280942cbb8a57f7a89eafc8e8918", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780326382, "uuid": "2d699b68-f227-4c10-b740-849f4e0f5e20", "comment": "Malware payload (KongTuke)", "value": "345597fe28b75dbad72973881a15a419a5908ad7", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780326382, "uuid": "6b38b398-52cb-422f-8afc-1e2e0d895ab4", "comment": "Malware payload (KongTuke)", "value": "4bc2f5daee41143f458d0d2d731c5de97c3136f2954b73a8be21b4a87448054eae24a299aa82aa30816b33e359ffff22", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780326382, "uuid": "57366e19-c705-463f-aafd-de1631627be6", "value": "T14614CDD6AF0A0F7513F5C9A752E881918E9188E4FE7E8706F4CFC861584C895F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780326382, "uuid": "d816e5e5-75b9-4387-91c8-35c18d9486cb", "value": "1536:0tsj/AW9Z7T5Pb0e/y+lLFJX3g53rj9v52+P4z15T:0ta/AW9hlPbBLJHgZ/F50vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780326382, "uuid": "fa66642a-4a27-49d5-9cdc-318f3e35da89", "value": 205653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780326382, "uuid": "6ab47e1a-6e7a-4496-b5d2-fe5370d2d902", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780326382, "uuid": "c7e50293-3c2e-4705-8eef-fec9069040e5", "value": "pool", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d017d8fa-5d70-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780287453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780287453, "uuid": "fa8f81b0-6576-426b-a722-1521c850c448", "comment": "Malware payload (Prometei)", "value": "792b3556d2e86799fdd4f67284596b19", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780287453, "uuid": "5c0680aa-9351-44ff-84ad-0d5bae0086f1", "comment": "Malware payload (Prometei)", "value": "8501a2aaa8b12bb2ff751d74120f36203d6bd1e92a2f468835a6e01d44f37c21", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780287453, "uuid": "0388c158-b864-4ae2-a4b1-74f80c1162f6", "comment": "Malware payload (Prometei)", "value": "aa24e5a8f2caed733686ddc7327d36a91a642881", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780287453, "uuid": "5e0ae6ab-3c5f-4976-a90b-6ee33b23f4ac", "comment": "Malware payload (Prometei)", "value": "3067313f4e8ee5f4d1bf19d1b9ac9305dcbd11016b31142a3bd47242b518a65bf052751896a800a25c3b0d1c4473baae", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780287453, "uuid": "75306c09-0606-4a61-99aa-187e954ef4a5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780287453, "uuid": "877b2171-25ba-4861-a578-b701647e82d7", "value": "3:B5BR:fBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780287453, "uuid": "c8aaf681-29fe-4c0b-90b2-12ffb77dfe6e", "value": 9, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780287453, "uuid": "05e77f76-821b-4782-8d2f-755c904096f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780287453, "uuid": "881e7923-69a8-4e88-a8fa-e3db5fca188f", "value": "8501a2aaa8b12bb2ff751d74120f36203d6bd1e92a2f468835a6e01d44f37c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312a5fbe-5ddb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780333142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333142, "uuid": "a77a9a9b-110e-4b0f-a0d3-59a92fa0b33a", "comment": "Malware payload (Mirai)", "value": "2775a2c21c9c67e907ed9499ef4dcb28", "object_relation": "md5", "Tag": [ { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333142, "uuid": "644ae75b-7578-4230-b54b-79d9ff041e63", "comment": "Malware payload (Mirai)", "value": "86d162d2e4ae90daad260faa7df25be2e28bc70a97d0d0548d80a670177a2739", "object_relation": "sha256", "Tag": [ { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333142, "uuid": "1d3fef85-f470-49c3-8e67-be38dc4b5884", "comment": "Malware payload (Mirai)", "value": "197b46e96304c8639bf35e0ff33bda4cd5f05660", "object_relation": "sha1", "Tag": [ { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780333142, "uuid": "30b36048-0e0b-49df-91be-bbd5f3aa1819", "comment": "Malware payload (Mirai)", "value": "78eca9d7cc9c365fb21f37fff3157b4f9d4fb241a07ffa0291669a069fb1cd94550fa8a68fe739a20523acb6e4259d67", "object_relation": "sha3-384", "Tag": [ { "name": "cpufreqd-disguise", "colour": "#E5231C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "http-flood", "colour": "#B97640", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "new-family", "colour": "#A4C805", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333142, "uuid": "b2bb34ad-4f5e-4273-8d3b-732241596e79", "value": "T10FA68B47EC6529E5C1ED8230897391527B717C494F2263D32F60F2297FB2BE4AAB9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333142, "uuid": "00b42e3d-5cd9-4f16-a7d6-7bafe913f7bc", "value": "98304:PMXdnGsKQGLpLyWCqpbIEHrYytNMHMOHDz86h3fWX4:PsGaG2JqXUuOMOk6lfWX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780333142, "uuid": "945f6dc2-fef7-46ff-876a-69d6610da821", "value": 9864677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780333142, "uuid": "343ea636-ac23-4d60-af22-c6a692bc4ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780333142, "uuid": "efeaabc3-0470-4409-9e3a-20b253167e2f", "value": "c2c_agent_x86_64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ea220d-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "3db1f4ec-2b80-4a90-a4d8-314cb36ec159", "comment": "Malware payload (Mirai)", "value": "c9c3ae576d681148cb360c239173c180", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "46c15aa8-464d-4f15-a783-f799a03d262f", "comment": "Malware payload (Mirai)", "value": "86e56f66b92f0754a49d0e35f0ff7ac143ab605bc67819d1785a1331112fedbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "4273f58e-6d5a-41e8-a8ee-c427ad23239e", "comment": "Malware payload (Mirai)", "value": "fb7963129752e31976c4837cc255330e6ac56c67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291509, "uuid": "12a2376f-13c3-4afc-8d74-f356ef5329c1", "comment": "Malware payload (Mirai)", "value": "457360c4c26b7f294d9978d13d01f6d52346991279ef9e1c38dded4b2fc0289f433ae596b083edb732f79fa456935879", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "339918cf-f1e1-4d41-aa20-6177abc39774", "value": "T1EFB33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "7e373023-7e94-40f9-9404-85d41c2377be", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJuZ:4azwz102cPPaRl+AS97JuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291509, "uuid": "a1853255-c7cd-4eb8-affb-812ca94e3359", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291509, "uuid": "b206f52a-6381-4a9e-914f-b3b199b4b48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291509, "uuid": "d7ca0aaa-72ad-4537-abbe-1886635ee27e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77676cb-5db8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780318389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318389, "uuid": "f3021e56-4249-4d33-a525-a789da5e4d17", "comment": "Malware payload", "value": "235c8c113db27b78ab05e5e98bbc57d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318389, "uuid": "09a96eec-c053-4116-b97c-27a32875f21a", "comment": "Malware payload", "value": "8705915c9ea20292dc1eb7effa3091b5c5c36bd00ff1e1b37dbda99c9c11f5fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318389, "uuid": "7ba1366c-67dd-4b57-8633-b7267dd924da", "comment": "Malware payload", "value": "87bbc0c5049aad9d06e69f30e8ea1b6c818b672c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318389, "uuid": "c849e324-4e35-4f44-b853-2164036274a0", "comment": "Malware payload", "value": "72be918626bb306c7e867f5ee504e5b714b4af5ef2ffaa38af9df1789e3100401b14373a878e6c7dafd0556e98d424e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318389, "uuid": "96dc46ea-9ee2-4144-8937-d9c5f0143245", "value": "T1B252A44BE7A2CD3BC4D196351687D270A2B398B49F21A32B250157B63A327C94F2F747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318389, "uuid": "f9f7390e-7f5f-45e0-bf75-2c4f3d00cb54", "value": "192:GyBZUW9TeN3ld5wK6NStaRboEZVLvyrJ4TlZXztnzAFmx14iCGDyr5Si:vaNPm4aRUEZlvyrJ4TlZXzNz8mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318389, "uuid": "c2f9d38e-a901-4465-a5f8-8afeda596a35", "value": 14376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318389, "uuid": "ea86c77b-de52-4d89-93dc-d842f9a29206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318389, "uuid": "e7d6eb16-6e2b-4710-a555-bb66bb05f5e9", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd778b7-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780316922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316922, "uuid": "8d643436-78ff-441f-b5ed-a9f0a2d32d90", "comment": "Malware payload", "value": "b95182a67075ea92c91fba316d44f2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316922, "uuid": "e64eb466-3a2b-43bd-9f3e-4e149438b5c4", "comment": "Malware payload", "value": "8765a68285521845c3c82b3ed49cd5fcec5fa099f557dd735f231c9f2c7af410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316922, "uuid": "c0cd9554-d5d3-4776-b980-4c7e4bfe94f7", "comment": "Malware payload", "value": "67ed41485e8c7ddc5a9af6ea1ebb59d841127b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316922, "uuid": "e3c11db6-25f9-413f-8b7d-d0fe96cb66a9", "comment": "Malware payload", "value": "3b695f6e01f9e9bdc3cf8363f8edae70f26a910fa4b72cd57c3c8746d57d041a5d664dea3cf8f78f11027e094a7a8e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316922, "uuid": "50cf0b3c-66aa-4e88-b69b-6a13d9a0b258", "value": "T11305383DCC54412FE1B7CA29C59A446FF4D1161B622CE94B10CB3B5FAE73A82B7A215C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316922, "uuid": "c810a4f8-ede6-41c0-a97c-fb3ba6bfaa92", "value": "3072:SOvLJAHfPMkK0HB6/TCpV4oo5klPhZYVHppaztiRlkHN0r8t6tbpJJbgnt1rUOgC:2s6WCL1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316922, "uuid": "d8290059-f97c-4306-a93d-6e63d111a401", "value": 872764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316922, "uuid": "0990d350-b419-4df5-82f7-20656db5beab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316922, "uuid": "2a278fae-5747-42ad-a645-71fdec596629", "value": "PRE-ALERT HTHC22031529.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc3a522-5d8b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780299017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299017, "uuid": "864bbd03-1534-436a-b2be-fba5786d2c95", "comment": "Malware payload (ConnectWise)", "value": "845d88efac3a4aaf9d81de7b611da42d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299017, "uuid": "e0a83d31-ed24-4654-9428-dd3c8f1485ae", "comment": "Malware payload (ConnectWise)", "value": "897dbe42e1cda05a6ffb86734faa357f826b54bcd57ba88439906a2df2e5808d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299017, "uuid": "2adcfa32-5c85-4061-9946-0f375abe0e40", "comment": "Malware payload (ConnectWise)", "value": "834e6130d7a1dfb98ae9f80945bfd87d4588e1d0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299017, "uuid": "87eb7e60-59bd-4b09-b06a-e4a5c13a9a72", "comment": "Malware payload (ConnectWise)", "value": "a3fa2ed6ea4e1e7a2efa4625829529958705cf9c760fdba7ed4a1d47fb0db8b9d2919c1942c2a504078f507e07095318", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299017, "uuid": "0a791bee-9423-4d0c-aea0-6dd7717c22f4", "value": "T1FF836C43B5D18475E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299017, "uuid": "ec0d7ef2-055e-4dfc-bd64-29c0a778a06d", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299017, "uuid": "6ccdf800-5e57-419f-a4ec-4265e937738f", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv7nJ:4enkyfPAwiMq0RqRfbaWZJYYvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299017, "uuid": "083a7557-524b-4f84-beea-acd4275c9bc8", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299017, "uuid": "af2e1d8b-a654-4880-979f-cd45f5473477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299017, "uuid": "08f30c41-0c36-4050-9b5d-aa1f4df07c5b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ce35e1-5d8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780299866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299866, "uuid": "39a56019-ded3-414d-afd2-23f583d66204", "comment": "Malware payload (Mirai)", "value": "8219c689cd3533386b22f612d1f5acb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299866, "uuid": "9be71f86-338c-4fb3-a267-e7c024eea84c", "comment": "Malware payload (Mirai)", "value": "89f695d9749aba86fad3f2dd4905b76ba0afc11c4a817cae56f3d11faf5ed30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299866, "uuid": "eef59b04-3ee5-4612-88d7-0151e6ee4593", "comment": "Malware payload (Mirai)", "value": "8de65108c2dce0bf100b31a06c46ba436f277bbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299866, "uuid": "21a12ae3-9bc9-4a2a-b3dd-bdc95c50a1d8", "comment": "Malware payload (Mirai)", "value": "3f788d775c57ae6a233a440f58633b0dc2ece422676de5151c38f2257f7912141ce7e3741de7af1b94c31220ea46ecb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299866, "uuid": "cdb47619-9276-48d9-ba25-edd8d81ed6c4", "value": "T10B735B35B6751A2BC4C4A97E16FB4B64B2F5224E28E8C61EBD730F4EBB315400A132F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299866, "uuid": "51344f00-00a2-494d-a4a7-0dc4ca139641", "value": "768:VhFjn1A+KqZp1yMhqp6qTgUb4H9tpQroI//t/CR/ue4O+wFSIYBA9/:Hx1A3opUR6qTj8H7p5Qt6lueSXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299866, "uuid": "8160f5f2-aa2f-46aa-a0ef-cf9f8610b7d7", "value": 75336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299866, "uuid": "be7f292c-3d22-4b62-9362-bc08a8c50c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299866, "uuid": "94474d78-19a2-4d2b-afe7-130fece895c7", "value": "fvgbh.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d722da-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297616, "uuid": "38587d84-1bba-49de-b898-2d35170b7fa7", "comment": "Malware payload (ConnectWise)", "value": "d3238dcb15167e72c5000fb31e356204", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297616, "uuid": "2b39d7ba-fd4b-404a-9aa2-911d63cfb5bb", "comment": "Malware payload (ConnectWise)", "value": "8a24b0b3b7cde6244c76687e6940cdb9ca804552bf1e584b704e7d17cb889184", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297616, "uuid": "9141a7c9-c878-4863-b2e1-fb97316d78d4", "comment": "Malware payload (ConnectWise)", "value": "cdf7baae824aa5dcdf4ff65e9b9c0d3945c2b7bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297616, "uuid": "17891295-008b-4d82-b8cf-1a1ddaed94c3", "comment": "Malware payload (ConnectWise)", "value": "70d6585066677951f92a112cd3356cfd5d4380627c8da33304409ed0a0b05f9e54c0fb6f183e4aacc686d107862bd236", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297616, "uuid": "e3ab4238-4293-4f21-99bd-63441d2fb79b", "value": "T11B46E101B3D695BAD1BF1638D87A52656774BC048312CBBF5794BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297616, "uuid": "9caefa50-72d4-4405-ac21-598c009f9648", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297616, "uuid": "c910e14c-c767-477a-ac39-4d8b3d83f25e", "value": "98304:DzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlq:DhfefPtHxcp9ym3nltDUJV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297616, "uuid": "aaaa2dc2-dc45-4948-95f3-87b182ed85c5", "value": 5730144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297616, "uuid": "9ed5f5a7-4294-4bc3-8893-70387145744d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297616, "uuid": "64349c9d-1d92-4c42-bfa5-1279b9348997", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bfa35f-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "3bcafea0-22e8-464f-ba58-7b92b4983ba9", "comment": "Malware payload (Mirai)", "value": "d5b00fa4e2422e4bd2bcff4079ee6e26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "8bd013ee-c68a-49fd-8384-e64041b159a8", "comment": "Malware payload (Mirai)", "value": "8a2bb6a72cd88790bdc50891c71ce9886b646dce99015000ed4fa70b2d02a721", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "89413e66-3ab8-44b6-8e70-27f1c8cad042", "comment": "Malware payload (Mirai)", "value": "0d02b0471336104d972c86e70d675c9e9d92ae15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293724, "uuid": "e56a35b4-b84e-4df4-879a-c094c33a9f2b", "comment": "Malware payload (Mirai)", "value": "8f5acd8a98a998c6c1da76254db88539cfdd4df71e980465f73b96f58dae85199449c062648a80707d779c17bc7c44e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "960ca5a4-a89f-4fae-ab07-b52265d95784", "value": "T19F635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "7d433bbd-32ac-4708-9654-b58b9c3e6d52", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPz:zGYxpTGASC4XTfyyLpIoYPsPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293724, "uuid": "44cdf004-7a3b-4c2f-a6a4-2152a78fca85", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293724, "uuid": "1ba675db-c5f8-482a-a066-db76ae60d253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293724, "uuid": "77f7344e-ac28-414b-a73e-713a804b3cb9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ecf9a3-5dab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312486, "uuid": "281d1a96-36fa-4cc0-9924-7e6524f4e635", "comment": "Malware payload (Mirai)", "value": "d5d13b91756b52e7d863d427dd1be5d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312486, "uuid": "985c8a9b-6f17-4173-8c19-01f6bdbeb72a", "comment": "Malware payload (Mirai)", "value": "8a3f5ee504e33fd7b53bb61f81e2fb34bc6ce73d2f4d0f8363b2be2a0f556870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312486, "uuid": "00a31088-6cd0-41ce-81c2-96de704eaf2e", "comment": "Malware payload (Mirai)", "value": "f3a1f4b90c172a565f3303327c35c15a0ccd9c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312486, "uuid": "8dec501b-a2b3-4ea0-a72f-9bb335ec2f9f", "comment": "Malware payload (Mirai)", "value": "08bbf8e714b19585d49a9fcb48c5fa626e578557855c8de9c441a50c823c08fa3fd98e14341f17c3f07f8b51b114c567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312486, "uuid": "f6ee81b3-3d30-4fe6-8229-1dffa0a7709f", "value": "T151833B07F58280FCC48AC1751B6FBA36D832B1FE1238B15B77D0EB226D49E612E1DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312486, "uuid": "3b08bf54-4dcf-48cd-a52b-b9d4b06799b1", "value": "1536:tPx9wWTcpwan0FCsd9xJ3ZwzTRIUICT63KCy71jS08PJsIseQdqMNXey3:+WQpPnQZX3ZwzT/e3KN1jS0MsIJQ9NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312486, "uuid": "0cd17b0a-f108-4fd9-b724-f36572cbcb77", "value": 87072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312486, "uuid": "5789351b-480d-4f73-84d5-27ecdb3da3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312486, "uuid": "30f8467e-1bef-4615-91b6-eb715b41ecfa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3b3506-5d54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780275154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780275154, "uuid": "4e08833f-da63-4b4c-8256-f09e24d9e86b", "comment": "Malware payload", "value": "a0c2f5e90b9e91c6788b4f4a609aad56", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780275154, "uuid": "3090d224-d3a3-46dc-8e4d-23e00644ae9a", "comment": "Malware payload", "value": "8a6027dc50d203dd810392da606eab524b27ac73dc68304d8e7147a2fdbad2dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780275154, "uuid": "a0b563de-8429-4158-b88b-5462c50f2ab4", "comment": "Malware payload", "value": "e7545f93967e75b3b265b8b04422d006ae77c356", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780275154, "uuid": "fee0c242-bf71-4676-93b6-69fa3ad15978", "comment": "Malware payload", "value": "96fe4e62fbb3a24b5adafb1f93e3190b6a95fd319f2941cae864487aad4d00783dc22efda09bf4defd431d0c260e586e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780275154, "uuid": "c71be72b-c0e4-46fe-989a-a4b363e04a62", "value": "T17DE533133FC6C8F1EB96AB701F65EB94AAE9F65007014EC797A10C0A5E056E5933E6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780275154, "uuid": "5c692daa-3a52-472f-8c73-6dd6e10d1f93", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780275154, "uuid": "fa68a1a3-553e-47f2-9d4f-a020f524d12e", "value": "98304:6Z5FJFiYigHx+LbxgW8nUE+ZN3bPLxMdXPqzbqWbe+Etq:6ZNHMnGtMz3XxMlPieWSBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780275154, "uuid": "ea09c32b-894c-4ca1-ac57-31ea6b3e817c", "value": 3224877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780275154, "uuid": "94ecc907-6377-414a-8b24-0a811a01dc23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780275154, "uuid": "33b88a04-d72a-4823-a0e6-87e55a58f352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d28e41-5de3-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1780336512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336512, "uuid": "5a93c5c5-a5c7-416e-a02d-8a5ca07798c6", "comment": "Malware payload (Arechclient2)", "value": "c779a6eaa654cd63e6311ba896d47511", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336512, "uuid": "97c1f8bc-2933-4b90-be16-b38ffd19c94e", "comment": "Malware payload (Arechclient2)", "value": "8ab13a8d2d4fa6f6131978f7c0afe966d1e5374b1a23982c2d4a8b695cfe01b4", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336512, "uuid": "4b3e725f-2d0b-405f-8208-32b9af75fcc7", "comment": "Malware payload (Arechclient2)", "value": "ea04b46fa51744ec839de5b251be504c0b54e4cc", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336512, "uuid": "f05bb6a7-e5c0-4a14-b62b-7ca7965e631a", "comment": "Malware payload (Arechclient2)", "value": "274152e4d5f3f248620d6b380c8c019a2076a13ff9c49788b3c1fd06ce28a6d286392bc24fd1f3e38302b5c1e3168975", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336512, "uuid": "e94e18f9-3870-4824-926b-5100a2ce5d07", "value": "T10C273317EDE6B639C86B0B399C20DA349F3DBCA87E90D82963153949A071FC193F4365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336512, "uuid": "4dc7743e-08b5-4593-8010-89941f10db76", "value": "393216:kajXtD7hWR0s+XF3xFgbJAfhKa6T079spKPKAvCDYmi2UBqWNgAiQF+CWRPsEEYl:LpYRB+V3xFYJA5Ka6QxDCAo5kgGgpP5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780336512, "uuid": "55aa3458-985c-48a3-991e-633d13ca9e6b", "value": 21299200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780336512, "uuid": "86fb15e3-a334-429b-a893-1b187f892211", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336512, "uuid": "4939cc88-2501-4c2a-887d-80ec7ef142ac", "value": "adv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494d607f-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277778, "uuid": "303af381-f50b-48d2-8cbf-31749bc520a0", "comment": "Malware payload", "value": "c13ccbd06af480e9945afff3121e1c91", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277778, "uuid": "ba634819-2c24-4540-be41-447fbae093ee", "comment": "Malware payload", "value": "8ad34c30650b03d1d16884e640f33d93491518d938400ef17215bf6d25b89239", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277778, "uuid": "3c6adf28-7435-4c55-9779-f77c08632518", "comment": "Malware payload", "value": "62ccb029c38a01682f0dc31ae37afa5bbf078c00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277778, "uuid": "6b99043d-6f3a-4417-ad5f-6eb3a1f40974", "comment": "Malware payload", "value": "7966719e93f398c96ec40440ebe94dd899f9e839cd745d7be3057b7cf487c0c47e247b46d7a4b3af0a0ebb1ca8e68ea5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277778, "uuid": "a6dcc0b2-b6be-4f3f-a2f3-7cb9311e72e1", "value": "T1A692D72173E89B72D7BB4FBCE465922513309F85A102DF192DAC30DE49DAF4585323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277778, "uuid": "fac1b299-ece0-40b8-a284-30bfc9b47260", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277778, "uuid": "f78ad91c-3ec8-47c7-9f0e-1c8266a29185", "value": "384:+EIuchW3g/RIQcnLWDHp9csN0Jr0EZ+i/emJx:fRSW38RIQcNIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277778, "uuid": "13094347-5076-4187-9aa2-f0e4d51eed11", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277778, "uuid": "187458a4-464f-484f-84bb-1d41ad0fc6a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277778, "uuid": "de4fc9cf-c100-4d9c-910c-03cce050fedf", "value": "8ad34c30650b03d1d16884e640f33d93491518d938400ef17215bf6d25b89239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d120fea2-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "561d2491-0dde-4dcd-a9d9-85936270856d", "comment": "Malware payload (Mirai)", "value": "b9e57f1c323432a50a46d1921dce7876", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "28ddb9f6-ee6a-4b49-9f45-e26d9e51e6e0", "comment": "Malware payload (Mirai)", "value": "8adc71c895b09af089e47e6bdec1d973f6dc9920811a5b5afef6a9d235ed1afa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "dd74bc35-85c7-4baa-a6dc-30c7cfdd34fb", "comment": "Malware payload (Mirai)", "value": "4f57cb8186430253e7b6c62795177688a6d125bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "770d9cd9-fed0-42f2-828f-650a339790da", "comment": "Malware payload (Mirai)", "value": "41dc1dbe37a74ada21b9a958e515a5d81cbdaf115da146598265cadd9474f945a4021b82feeaa0bbedd6ea6cde8f77e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "be32b907-e9ba-420e-9b0c-17bb03588061", "value": "T1CAC3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "d0f34be0-31d7-4d80-a06e-8716ffb7c6e5", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3e0j:IaOulLUUogcQ9BvMEWSWC2h3e0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292179, "uuid": "aec303b4-dc68-4a35-a62f-ccf391911447", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292179, "uuid": "bf1e97c0-c495-488d-8ead-cc8abcc2897a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "b45142f9-9a8d-4077-b9e0-b46fa3583ec3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcd5977-5d57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780276497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276497, "uuid": "8bceba46-6004-4c2d-acc0-44e4ffd2b558", "comment": "Malware payload", "value": "81ffff3818d4b51e5e0f77d557fdad22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276497, "uuid": "67769d32-612c-456b-9abb-92530ecdb335", "comment": "Malware payload", "value": "8b1eeeeb14ae01e0826b17e5e1385866b89b333599168e9d9790c69a8c55c68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276497, "uuid": "792d0557-f180-4f06-ba1f-259ef6676439", "comment": "Malware payload", "value": "c4012b1500a4b6dfa4f613d08a0be6b22f9f8292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276497, "uuid": "9c3a9d36-6986-486c-904a-b54e4ffa1f5e", "comment": "Malware payload", "value": "883e81e30648fd2050985fa70ef39e63fe518bcc79ae864dcc1922fc034924db80828b93c83601861f2a369ea570482b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276497, "uuid": "bccb0ab7-9923-4777-80d4-944439e56e00", "value": "T13B866C73945224D8E1ADC974D5141612BDB8388B573873CBBAC476F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276497, "uuid": "d9cc6df5-757c-414f-bdef-67b8496b67c6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQJ:cqYUQuVDt0TZEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780276497, "uuid": "c90040e0-219e-4f49-87da-961cb363c9a1", "value": 8355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780276497, "uuid": "6118d2a3-399e-4199-82bc-7b4be5438a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276497, "uuid": "b368665b-a54e-4473-9048-3ebb21ed83e7", "value": "8b1eeeeb14ae01e0826b17e5e1385866b89b333599168e9d9790c69a8c55c68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0564698-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "6f49d251-c8ab-420c-aa6f-253a2dce2711", "comment": "Malware payload (Mirai)", "value": "994559063bf44bb38cba170266947a31", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "220c0d2f-04e0-4fc0-aadd-992ebbfabf43", "comment": "Malware payload (Mirai)", "value": "8b82d8824183a4d1b3774381d09991989cde685100466a2df9e06b9113af879c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "6f30a7cf-2184-4243-b084-18c5aca33792", "comment": "Malware payload (Mirai)", "value": "0a9fc242269c1b2c73674a1bea02e060a419e671", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "0a9cd9d8-17e8-4fb3-823a-ea071cff2882", "comment": "Malware payload (Mirai)", "value": "8156f6a1ff6f0266cacb1dbbae7f4df17e6a67e2eb4a710aba31db300a62690a8e3cc90ba9ca4dffab46bb266e569cc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "546b628a-892c-4772-9e71-ad4e6976c37e", "value": "T129C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "72207191-c714-4603-9720-f8f6c0e7e0e5", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPKO:LzhWutxBaORaebXQd+mzBzlkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292178, "uuid": "39931a0a-7956-4cd1-9347-8f9699802710", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292178, "uuid": "1690f0fc-4bd9-47df-9920-1819ad62f903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "0dee12ba-e523-4aad-99a6-c5525d1c6860", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0446b8cc-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322330, "uuid": "9028398a-5f6a-4084-a995-23b3c30780e8", "comment": "Malware payload (Mirai)", "value": "3123453ad22aef9fd5372b95ed807742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322330, "uuid": "6a5f18cf-159d-4f77-93a1-370179f1771a", "comment": "Malware payload (Mirai)", "value": "8c1d4f3d132289c530f1ab0d3fb2c7e6d8f26d4e7264b04c48150b07d707fe5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322330, "uuid": "5476feb2-0d7a-48f8-906a-538fe737dcd6", "comment": "Malware payload (Mirai)", "value": "0f9c71af62003465b00c42cae36b8eaeef73f069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322330, "uuid": "83b8fa5a-922f-4981-9e53-7f8d3104d204", "comment": "Malware payload (Mirai)", "value": "525fea4e3bd8d24a05c899cba90cb36547a206699a515a1c2c05a40c172e763c2c77498fbcdaa7511ba4043a937eb88a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322330, "uuid": "59c9c21f-f5ad-4312-a7ef-21f39b27d0c6", "value": "T1EF03E10295DA8A17C3DF933D26BE611B2C64D258318441BBE6C5834B72EAF1C2F5EF52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322330, "uuid": "025b7223-e071-4ae7-b743-185f33ecc2b5", "value": "768:JGzCojKJ+ieTZF8KhPNqWhgHyHDGyAhP/lN8B0rqbUKnbcuyD7UHQRj6:Jy9OJATLhPUWiHGUtN6nbUKnouy8Hye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322330, "uuid": "ea602fc5-314d-41df-8dac-7927a93a38b2", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322330, "uuid": "c88bb198-8f87-4bdc-aeb4-8b13d77bbab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322330, "uuid": "78827aa9-8491-4fa7-af48-44befda708cf", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819872c9-5d65-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780282597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780282597, "uuid": "cc054e13-1f95-4ac9-b9c3-840bb9160a99", "comment": "Malware payload (AgentTesla)", "value": "2a1eca55b51eeca53dbba0ba00f3c553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780282597, "uuid": "4ef6da1f-410e-43ab-bafa-46e1fac5cfc5", "comment": "Malware payload (AgentTesla)", "value": "8c49fab426c3cf1cd3c39332b8f287c9049fa49db760f73c21e9241bfa574d9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780282597, "uuid": "936d52e0-1b43-414c-b0a8-b88a9de4f091", "comment": "Malware payload (AgentTesla)", "value": "5c58000efa10e380a70aee873b10d845020a797d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780282597, "uuid": "7dbc018e-be0b-471a-a625-e258246d3011", "comment": "Malware payload (AgentTesla)", "value": "446cb31f0f811a49f21e95783c41cef11a264ac60dd2fcdc748413147b744e006c18eceabe051a2eec62d5924ffbf515", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780282597, "uuid": "54202a24-0507-4f40-8e5a-e8dd044b7052", "value": "T11C3512557799CB42C8E21BB85930E77613796E8CE620C72B5EF6BCDF78643062A0C253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780282597, "uuid": "ce616f3e-b6fa-4417-b271-a05c56e21278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780282597, "uuid": "131cf660-5b0e-44a7-93b0-981a505dfba1", "value": "24576:xAtO+L08+gL4/7jbBQpBtpuXdTGfHZq6XHHvS2t9PoY:xAtO1dnHbBQpRCdSZqU6+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780282597, "uuid": "ddba03f3-5cf8-41db-9d07-dc57d1468c2f", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780282597, "uuid": "5a86eb6f-621e-46c6-a90a-d679129a1968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780282597, "uuid": "fc93393c-d1af-4b98-99bf-402c714a4ac8", "value": "RFQ_New_Order_13600.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bcfce2-5d67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780283620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "c53af2b9-6511-4226-b147-b8ee08ce615f", "comment": "Malware payload (Mirai)", "value": "51a4f33d835483de3b005cee25fc456a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "39b5ad01-a00a-4828-9cbf-a9af4ecff0e5", "comment": "Malware payload (Mirai)", "value": "8c60319a68d01488933ca85e893fe73ecb20d79c29c4478dd6a8dbc2a84d92aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "496fbf99-535b-44f2-9f54-1581784dee89", "comment": "Malware payload (Mirai)", "value": "810dc4c5bc4088a03b2014dade1c8c3d4ee1a040", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780283620, "uuid": "fe7f03ef-2bba-48c5-931f-a6df5e8e1292", "comment": "Malware payload (Mirai)", "value": "b672430519a22b3014d4b53800acb3a1000f9cecf610321a5518978c497878bebfb5bb170959a330ee9e09a6480121fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "29bd5571-7daa-4740-85b3-49bc622ad918", "value": "T1B2E04FEA6809225240A8ED84F077C959F03FF3D63510864CBC9E30A988D8E28F119B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "fe3a88b6-55f6-4080-9d45-4132d257093d", "value": "6:L6FnGj5AANaa6yPJV6F45AAPoJKPJV6FTWX5AAvbTnPJV6FLX5AA6KlKO:KGj5AANf5hN5AAsKhau5AAjTnheX5AAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780283620, "uuid": "53f2c9f1-78d7-47f7-a364-46adad1f9677", "value": 318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780283620, "uuid": "99953cd3-bb2b-4e28-97d2-a1af484b4fbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780283620, "uuid": "317f4dc9-2eeb-4bf8-95cf-72d822178302", "value": "tplink", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc7c2f8-5d9d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780306640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306640, "uuid": "1c17f143-82cb-47e5-9672-41bb0f5bb839", "comment": "Malware payload (AgentTesla)", "value": "d7c49ac9d16c5e2b0c648f911177a847", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306640, "uuid": "6e44e1ed-ab92-4959-90bb-c8a1ab62a09a", "comment": "Malware payload (AgentTesla)", "value": "8ce17511080f6da2229975780b741972b96e71ca123dab42ceb5466403e27eab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306640, "uuid": "5af60710-baa4-4329-90fa-5e6ac7dd3ceb", "comment": "Malware payload (AgentTesla)", "value": "d81d51a19772f282c9c949b4c66c19e1ed76d610", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780306640, "uuid": "ae79c4b7-9cfa-4b8a-9060-2da8f901337b", "comment": "Malware payload (AgentTesla)", "value": "d3f78fb5c73550a3ee3935e1d10835dc376cd7ece4f17ebac91d1fee92b859937a01ea38ae9ac85d4183519309a24d97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306640, "uuid": "23f6bfff-af12-48c4-a47b-c881739c2677", "value": "T1434608536997911B730E879E8972F9E1E80E2D27B4035507706CDC28B3EFD9762A9233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306640, "uuid": "a6200c7f-1e5e-48fd-ad08-84bf655334c1", "value": "98304:S+iwqWXCPUlWffmnXzjWV9/v1nEbNAo4PMc3EqWnKz6/BEd2iiEq9Kar5ScmwIbZ:S+iwqWXCPaWffmXzjWV9X1nEbNAo4PMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780306640, "uuid": "492caa50-0e45-4ccf-b2ea-1497395c2adf", "value": 5843105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780306640, "uuid": "4c8a0311-af9d-4e13-a6d7-1d8fec9253f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780306640, "uuid": "21a94d39-3450-4e1a-bf03-7221fd8de803", "value": "kibluska.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcb4d32-5dbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780319500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780319500, "uuid": "66a132e5-1ff1-48e8-98fb-25c282e98d58", "comment": "Malware payload (Mirai)", "value": "d378d436b4ab54f971d68fa5eb3955ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780319500, "uuid": "4876b14d-8a84-4974-a54e-3471e7f0606b", "comment": "Malware payload (Mirai)", "value": "8d493c33f31ad36efae062d271ed29b5146c3428e2ce37d2b1af46cbff53e9b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780319500, "uuid": "2126c019-2472-4c41-936d-caa039c45836", "comment": "Malware payload (Mirai)", "value": "41d40474da9f15f8d039244a07c294fecebf5af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780319500, "uuid": "368e7e5a-b9ac-4a42-94f9-7fab4a2c6047", "comment": "Malware payload (Mirai)", "value": "4e0cf2a2ffb05b8c69e4a17908b5f2cf40210e0731f1206bfc3864d4a7aa11040cd7ac0f1a7ae90c5dc5e1e064bd57d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780319500, "uuid": "ebd9435b-03c7-4426-a7b9-c68fc32d74f8", "value": "T13F24B61A3A22EFFFF168863007F38A7097E5259636A19745F26CD71C1F2028D685F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780319500, "uuid": "3102e1ae-ab79-4f07-87aa-b0958d8bdcc3", "value": "3072:/BA0o20YPukHbCRfnRHRQPOTRcGAmoz9nzBsNcPUTkFizT:Z/PH0fn9w8RVAmoz9nzBsNcPUTkFizT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780319500, "uuid": "bafa37f3-203c-4284-b50b-40798a7d5239", "value": 227640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780319500, "uuid": "3b2a057b-342b-4e8b-8eda-3d49247ceb91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780319500, "uuid": "34cc81f1-15e4-4dcb-bc44-e9381481695f", "value": "8d493c33f31ad36efae062d271ed29b5146c3428e2ce37d2b1af46cbff53e9b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c763774-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278159, "uuid": "4a831bcc-56e9-4918-8ad9-84f5f9cf87ff", "comment": "Malware payload (Mirai)", "value": "5973d9b652dc9f59016426473916c0cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278159, "uuid": "14359801-6476-4061-a272-62fe792ceb0b", "comment": "Malware payload (Mirai)", "value": "8d6e2976bfcf1a97566e1d6f54364ce40e738d3757fa194fcdbec56c9799203f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278159, "uuid": "79a9d610-2e8e-4b83-97f1-1772b7358926", "comment": "Malware payload (Mirai)", "value": "ebb52539a36af5f32b93cc05f80acc553ebec87a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278159, "uuid": "04a8a64e-46d2-4dc9-a696-943a5b6df46d", "comment": "Malware payload (Mirai)", "value": "0e0d7107b2dc6cfd53d05f0fe96f9e4856408c5e375dde625508922d867184632f6b9078f64e45293535f319b7e56c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278159, "uuid": "49e21b10-7d6e-42c1-88b4-f4a21c27d72b", "value": "T1A2634A96B4016D3CFC4FE6BA81114F09F93273695E430A6A91A3FCB35C321E46A67E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278159, "uuid": "be23d5e3-da4a-4ba8-9eed-7151131938d1", "value": "1536:oq2dQMnvzhv2HLYwa2sUn8NiCM/CRDG7w5TY:yROa2tTCRDqEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278159, "uuid": "16e28e80-0935-4f77-b25b-8906903a5c9c", "value": 68368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278159, "uuid": "225a4033-5476-4fb3-a423-fad29277b198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278159, "uuid": "2731976e-0a12-470c-897f-39240965da1f", "value": "8d6e2976bfcf1a97566e1d6f54364ce40e738d3757fa194fcdbec56c9799203f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e245ce98-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1780346754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346754, "uuid": "956797ec-6523-46e3-ad0c-affeffdf9b3d", "comment": "Malware payload (LeetHozer)", "value": "ac7711e979caf6f984a4931921727b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346754, "uuid": "f818b661-016e-44f6-a3a0-dcfc2fb9fd59", "comment": "Malware payload (LeetHozer)", "value": "8de18340455bffb35a7df9520fb848e61c548fce9eebbccfdb7eee42fd90bd3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346754, "uuid": "0d0575bc-9f3c-4845-83b0-e13643049772", "comment": "Malware payload (LeetHozer)", "value": "756b4145df3cc4662fd0fae3a3f7f88f389fa489", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346754, "uuid": "6d4ef926-bdfa-4101-a63b-b3e24438c9db", "comment": "Malware payload (LeetHozer)", "value": "b208f5253b0c9731c000d1e6fe3632fe96d6e0e9025aad9f4bebe4ce0bf2f525fdee72cab1938b8cceb2c7fa342026d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346754, "uuid": "a54b3268-9606-41b8-8676-c3eb89a9aa16", "value": "T1E713024C340C5536EEB00976D0789A8773A86B36C0F233B08E7406D9E645C7757B8A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346754, "uuid": "de7d8292-3ec5-45c0-8b20-3219d7a8b1aa", "value": "768:T2YrXdeY2BtoRmdRs4D4UlbDetZfBMwTHzB9UCxvX4SGTlgs3UozP:T2UXwY2BaR0HxuVhjzDgSwVzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346754, "uuid": "0c70dd22-e9c7-4c12-b892-16f44fcf03b3", "value": 43228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346754, "uuid": "016f4172-2aad-4af1-9a22-0796ddd2f549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346754, "uuid": "7ebac6c3-f247-43fd-b207-c1b59766f731", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52d3707-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297689, "uuid": "605cc759-787f-40c7-b40a-64bbc1799296", "comment": "Malware payload (ConnectWise)", "value": "0e35c40c0cedc470b9b33990bc0fedfd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297689, "uuid": "1984205f-ac7b-48a6-b76b-06391f58a284", "comment": "Malware payload (ConnectWise)", "value": "8ed3f83f57bf76261f403dc9b2f9773f403fb4657c4437a95c7df42b13b6a2fb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297689, "uuid": "8f94568f-beff-408d-829c-3193c5798c3d", "comment": "Malware payload (ConnectWise)", "value": "025176271a6028722e223e0e16232986ad7408f5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297689, "uuid": "f5bbc75c-9021-4a16-96de-8d7f7ec61f7d", "comment": "Malware payload (ConnectWise)", "value": "252f5f0f376fcce01c98cdaeb89da06e84c3300480da67ad434fd059b51f9eab830ad3cf98d5c3efff781c99b5584245", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297689, "uuid": "1f224aac-22e8-43ca-be8d-420cc470f848", "value": "T1F2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297689, "uuid": "ba651669-b0ee-4a46-8d5d-1e8f81b058b2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297689, "uuid": "0fa07fe9-d95e-4933-9d7b-a92b1ea59cc5", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji96:51iw7gryNkSV1hy1Z1u2JLu96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297689, "uuid": "98fc846a-fc43-4339-a44b-183aad756f31", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297689, "uuid": "f3b88249-409f-4b7e-9c24-0a02790d231a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297689, "uuid": "6496e0a6-91ed-4cc3-8460-243b50470df5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6212feea-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292422, "uuid": "88936e26-25fd-4ea1-b5b5-de1ff99e10de", "comment": "Malware payload (Mirai)", "value": "ea40c8a6fb5ca18c3214f49848b8d43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292422, "uuid": "897f834e-b6f4-40bc-b3a6-ff0a2766a213", "comment": "Malware payload (Mirai)", "value": "8f6a7ff4424134e547d39be0822e960dc100e621eae7af3e5eed1bdee1751889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292422, "uuid": "15034dd1-8edf-4616-aaaa-a5ef8ac343cd", "comment": "Malware payload (Mirai)", "value": "80dd02d680e4b7f0ae1a8561daa41647257d5f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292422, "uuid": "12106065-aca9-4435-ba1e-64bd84c2dab2", "comment": "Malware payload (Mirai)", "value": "cc98a924a71be00f26a25d557c181e7da0fdf82b6a71c23d2790ff876c930d55dcc6d223671784ecfca82dad25c6a4a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292422, "uuid": "3ff6a78b-d34c-4640-accd-23eb09eac8bf", "value": "T17EC3C50ABF950FBBDC9BCC370AE92B05288D665722B97B367930D818B54B24F55D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292422, "uuid": "27aaaa91-c303-4b47-80ea-881bd2b07cfc", "value": "1536:ZwH9TgukJYcicQtm+VoNOUqK6AEdggeTI6laKENeP5IZ4k886ZEEvZ335iS0:qH9TgjJYhDtm+VoNO/YlaCk886/4S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292422, "uuid": "aa953c4d-0455-4570-9f8c-0b4813ac1186", "value": 130000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292422, "uuid": "26933c08-b4d1-4214-a861-2d09e02e1adc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292422, "uuid": "7e85f489-f961-4481-966b-2ed5f3414897", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426cc8fa-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "7201c139-c044-4f71-82fc-1ee6706b7f77", "comment": "Malware payload (Mirai)", "value": "74dc8c309210659cb73de9a4eebeb037", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "f33772eb-e193-4cd2-a56f-bf818b2efd4f", "comment": "Malware payload (Mirai)", "value": "9005273ca5d0730a0590d077f6cfad317d1b8cded60622232d5b5e676624f2be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "8b88470e-f6fa-4de2-8782-dc6210eb363a", "comment": "Malware payload (Mirai)", "value": "0b8cc2bc219c1130b093a6109d2b0e50d1d90dc8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "713280bc-e93d-4b32-b796-f035a0b50f67", "comment": "Malware payload (Mirai)", "value": "79dfa9536b0589246f132e3adb77afa55c9fbc45cce3e580175ccaaadb46c69d205f7e02dd653c04638d6af9ff0f69eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "3e852cde-4bd4-4121-9bc9-f91c0916300c", "value": "T125732B81F94B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "158d2aa3-8926-4cca-9f3a-a38c36b1f3cc", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHlx:uVFrPNQn+WVQ3EXVUk29jgxOlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291510, "uuid": "344913c5-0de2-4a3d-8ff5-5cb00d63e302", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291510, "uuid": "c7cce79f-67b6-441b-89e2-2051f6d54786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "13b5dc66-cff6-401b-8629-8aa5b5a7c574", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb7b7b0-5dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780341403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341403, "uuid": "00ef842d-73de-4609-992b-af8b307bb1b9", "comment": "Malware payload", "value": "2a6582d773b7b8e2f01375da1c075cb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341403, "uuid": "4d43e353-4289-40bd-8012-09877c0a53bb", "comment": "Malware payload", "value": "90600a7e23217b5d0924c6bfe0026edb317165e8ec342c9916e5565141b174c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341403, "uuid": "da06d6c1-443c-415a-a38e-51a4f96b274f", "comment": "Malware payload", "value": "6648bb1297008347c852ba5ca9d3f5bc1f792710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780341403, "uuid": "a099de25-dd31-460f-9d21-308ba4726283", "comment": "Malware payload", "value": "7f3f209a887d23f98a7bd297a1b38609750b37bd3baceccacc1a7d230a72cf67542b7f80ade8ee49ac26e8a3854c377b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341403, "uuid": "a221cefb-9b09-46b0-a684-bb6766f23e87", "value": "T19DB65C06BCC42BBAC46C4A7484FACA5522B05E144AF1466A6165FFECBC772797F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341403, "uuid": "2fcb387d-84b9-4c50-9097-33b494983cb0", "value": "98304:QBHCDt8MiEhJPW0ZGOeLQptPlOyGQcIGCX4Zcxg:ACKMvhJPW08OeL8lOczJX4ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780341403, "uuid": "5393cf81-4ef5-4443-8365-a942ac66f1d3", "value": 10897553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780341403, "uuid": "9de9f676-c9aa-4f2c-ac9e-aa86e96b6b22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780341403, "uuid": "2aef8519-a541-4556-9957-0791cd8361cf", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee16311-5da0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780307771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307771, "uuid": "dd7f5cc0-0ac7-4ddb-9b8d-cef57975b483", "comment": "Malware payload", "value": "d7926da0d76b8c275ede12976c93e5f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307771, "uuid": "f70f7d86-972c-46d5-9b93-8dbc5e7a45d6", "comment": "Malware payload", "value": "90655d3212d303734929376c544717bea52525fc1b7b7622bee025453dab1ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307771, "uuid": "a783bd5d-a969-4706-88f7-0458e42f12b8", "comment": "Malware payload", "value": "89e6359b3f7091755d4dc1f58ead7dd150fcb09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307771, "uuid": "0cc71721-292a-488c-8551-14ce098fa6b9", "comment": "Malware payload", "value": "ac6eeb3affb8d7a6e7d73567e2ba15886c75b5a0a0a650efa86292d7127c398a56f45f4d7c7004f7cc9bfe451c511e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307771, "uuid": "b5c7e147-2c77-41cd-8403-171c350278f3", "value": "T12B183379A265133ACE481FB951B0023209FFBF726F7591BFAA91746D9E335878830C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307771, "uuid": "79305873-ea98-4269-beea-635783a93e08", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307771, "uuid": "8db3cd19-fbc9-4e02-9de9-e01fd4dfa1e9", "value": "1572864:trziNx5qSMG4CKUyn8TIHzFV7w2rOs5FkD7RPR7:Ix5qSMG4OyFzbhis5Qz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780307771, "uuid": "ddec7a86-df68-4c7e-93b7-452274de832c", "value": 85738655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780307771, "uuid": "0e264fe4-a7c2-41d8-84e9-bcbbebaf981d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307771, "uuid": "4e8c3fbf-4ad1-437f-a2c0-be788b0fedc9", "value": "WindowsUpdateAssistant_v3.0_xpuk7s2bo2tc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bceb27a-5dc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780321725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321725, "uuid": "a9bf5256-1b16-47a7-a020-891f34a05569", "comment": "Malware payload", "value": "98d490825cf10c273ec30a8946bd24a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321725, "uuid": "4cca26c4-2f94-45c6-b6ff-09e8d4d00707", "comment": "Malware payload", "value": "938817622b9b928c808c7b65de71890a475aa2540bc64c3ad1c93a6300e1505d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321725, "uuid": "3a3c9948-559f-4a6c-aefd-99db886b108c", "comment": "Malware payload", "value": "1761ecc80b24a536516941f026d524281c5b640b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321725, "uuid": "af2bc204-e11f-4479-9389-6d947aae418d", "comment": "Malware payload", "value": "c7b346418acd16b6d06c3f5b471de54c70608d3ad3facb3ff1832334aa0162035534c6b3520a10c1784626569f39c78d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321725, "uuid": "1f2f16b4-df6c-4950-a3b1-9fc509b9bd3a", "value": "T145137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321725, "uuid": "427502b9-3556-4e3a-bf93-c77b3b1f6b8e", "value": "768:x+m9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:x+Dco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780321725, "uuid": "d49f268e-81ad-42d7-ae6f-19bf6cfe84ef", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780321725, "uuid": "fdc4f547-b700-4142-9b22-3ab6fe0a011e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321725, "uuid": "e3dc16c2-7873-4da0-8d28-899baa7aa159", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cc8c59-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "35ddecef-6928-4af4-990d-ba1402b64950", "comment": "Malware payload (Mirai)", "value": "2022250857c617594df8b32b351a4c4e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "3eda1c67-9659-409b-a4c2-0d6b0e0c56d3", "comment": "Malware payload (Mirai)", "value": "93971c722652c94441d3b49f124882dbab2e398a994b2f0f9cffb99abf48fb41", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "086db624-79fd-4151-a61a-bff9e4beec24", "comment": "Malware payload (Mirai)", "value": "a5b0f8908553354f2b02be19ce8d92384b4f477f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291511, "uuid": "d0b54431-3e88-4e9f-8af4-329f2dbdf2e0", "comment": "Malware payload (Mirai)", "value": "51365b036e54dc9f312e2c1c53a6ab3cc55ca0ef058f19ad01a6d8d7d5a14bc8af0007ab0cc2e06d59a5e91b069186fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "30023cf9-891d-42dc-a3a8-c44d9cd262b9", "value": "T1E2C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "f02df8df-bdae-473b-ae93-1f1f2d060887", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3e30j:IaOulLUUogcQ9BvMEWSWC2h3e30j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291511, "uuid": "69b55c1e-6dfb-444c-8242-8fcbd6299d1f", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291511, "uuid": "45143cf8-bd21-4820-9bcd-8db32684f865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291511, "uuid": "33c83728-6c55-42ef-9c44-f6c6597f98c8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46272091-5dad-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1780313421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313421, "uuid": "5679fbcc-5393-4806-a91e-fef796f307d8", "comment": "Malware payload (FRP)", "value": "10298ad230f77f59e0e5805ea41431d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313421, "uuid": "44c57279-7de4-45a5-a8db-8dfaf02d6529", "comment": "Malware payload (FRP)", "value": "96103cf8fce293e362b32497b8e9c2c7c091ddf75f77ee9c15b467722e895bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313421, "uuid": "f5f2c13b-fbf5-44d6-89d6-3a32c027c8ef", "comment": "Malware payload (FRP)", "value": "6adfcceb02b67eff2a0a582d90a2bab670d4badb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780313421, "uuid": "4da23590-7a85-49f6-aa78-4e2079cebdef", "comment": "Malware payload (FRP)", "value": "f99d23639461829dc844e7f3236f0e0574035ee04ec849b5f742473c03c82ef262f8d553d72fe7f4e4cfe733fe218266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313421, "uuid": "8787a08a-6b01-43c1-bc13-cb588a40e1ce", "value": "T1A7074A43EC6611E9C5ADE2B1C9A692627B72BC85472223D71B50F6307F33BD06DBA350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313421, "uuid": "dbb2f5f3-03d7-404f-880a-71c96e41c1e4", "value": "fded4768f310c3387d552ea4846492b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313421, "uuid": "cee27da6-5f19-4900-a7ea-561af7e1844c", "value": "98304:/yRAWrEU/k+QYpLWkCO//Su4GnJxSBj9jreP5GZJULJVP94AbwKEADz:K5gU/k+Pl4GSj9jrWkiLJdOAUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780313421, "uuid": "12b1c257-aba0-42d7-a52f-ef4c33a3e5d3", "value": 17814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780313421, "uuid": "2a5742a6-34b2-4246-b0c4-b8fb34766ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780313421, "uuid": "9c607200-51dc-424c-bd7d-a9ae18ad6980", "value": "96103cf8fce293e362b32497b8e9c2c7c091ddf75f77ee9c15b467722e895bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b102d2-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "6ca369e9-624f-4255-9aa6-8e3f96031bfa", "comment": "Malware payload (Mirai)", "value": "db73b9d03fd2e75f3b0d38d1f46ecea9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "a04dd8be-4df1-44f0-ba7b-4cb8cb190163", "comment": "Malware payload (Mirai)", "value": "969a3d8724f786af7302b0177a0e7915c3ed1e6f7f347fc92c9f6e0365d43e44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "ee1030a7-dc15-4f8e-96c2-fbeb945ff464", "comment": "Malware payload (Mirai)", "value": "33f234243e8511a1662ba1c9f4d3d3d103e10aa6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292180, "uuid": "c40bbf67-54b1-44e5-be01-2d8dd44e8ddf", "comment": "Malware payload (Mirai)", "value": "0f6eb7085e05dc60e403821f9789d5a1cbd5aeff1c92596648e40920b2a305ac0bcf662d3e0b86f0b34b6bd254eb00ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "11472f4e-875b-4317-97e4-84418f96c9c7", "value": "T1E2934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "ee2c6a5a-ed44-41f8-b296-e48141da4982", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINXS:XGptyz+VJzB7T9/bLUAx9e/SBJOXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292180, "uuid": "ba0c1357-047a-49ca-afc9-53f801c4fcab", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292180, "uuid": "7ab6fd05-fc63-4855-9bb6-87fec7451ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292180, "uuid": "ebc53fb9-2936-47ff-b184-4ae394681f5c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f437848f-5de3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780336906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336906, "uuid": "677ef2d9-8b4d-4115-a2fc-88fd470ca560", "comment": "Malware payload (RemusStealer)", "value": "eb102097c20bfbede5907b14173cad12", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336906, "uuid": "02b481d2-8dd9-41aa-ba9d-44f02d9673b4", "comment": "Malware payload (RemusStealer)", "value": "970a5c67346033c9a3a39f8920f3a251a7c9fddfa52b2aea55f8ae4a4c878190", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336906, "uuid": "c1fd8ad6-6cd9-4120-b16f-bc4b4d929631", "comment": "Malware payload (RemusStealer)", "value": "90fc6a00f4c39a18c02793535f55ef8246bf41ca", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780336906, "uuid": "57528cbf-a065-4bdb-af5a-637db87f6947", "comment": "Malware payload (RemusStealer)", "value": "533155026c9b8ee3f34794e0d081d3e419ab48e3c2c82387a535155ea2c0b030ca1c8305fa07a69916ad73d97879365d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336906, "uuid": "6b8e8233-e01c-4971-bbd2-5fc90b746467", "value": "T13F46332460C90616D3E939319F81F97723913EDC2B74A0AB92F07D1B78FE99B5920E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336906, "uuid": "62317f4c-6d0a-4b70-a508-d2669696fa22", "value": "98304:Z76N+5tOUmYf84UQy+L6p8aW4viDaBPKzbcouNSL7vBK7kgx2R:Z+QQYfny+GpjWj2Pc/Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780336906, "uuid": "8932ecce-ce11-4e77-bc52-b370521c7a78", "value": 5688832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780336906, "uuid": "978c4cfd-a8bf-41db-8c91-fb7ec3a9abe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780336906, "uuid": "2e9db75b-31b9-4346-9721-449ebdd7efea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19336670-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274261, "uuid": "59b9c766-6225-4db7-8c5b-0bd09611265f", "comment": "Malware payload (Mirai)", "value": "55b80a4101752d74029add3e325755b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274261, "uuid": "b010a80e-eddd-4bcd-9085-c3c9948a9d70", "comment": "Malware payload (Mirai)", "value": "982d1231ca3dcef9acf99b57d9d104425e18a7dfa5f97110f10dfe0d4b1342d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274261, "uuid": "2077bd10-9396-4b96-a25e-22324b189a23", "comment": "Malware payload (Mirai)", "value": "25d84367513701bfdca7b84bb44af5a00bdf468d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274261, "uuid": "263f81d4-219b-4359-9c74-0f3e2df068da", "comment": "Malware payload (Mirai)", "value": "7a864d019b199dd985fa3b60afcc1275cf84b0e8e2b6662b482189528fcad483d24929ac80a356904588f401b726006d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274261, "uuid": "b1738e81-6026-4fd4-998d-8935bffc3fc6", "value": "T11743F1BFAF822AB2C4F1243147084A861976873856A436B770EBE01CD2562D776F649E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274261, "uuid": "8dc4bb32-a842-4a8f-ac8a-a03d055eac69", "value": "1536:8ccRgTouM0qi6e5VU4ajvlwMO9LX5yfmDVRty25m1:8LRgTZNq2/E+/9Lgfmjg2c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274261, "uuid": "51db75be-df6a-4db0-a4c6-0c7de6516113", "value": 59084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274261, "uuid": "dcbaa1e7-e7fb-4a85-ae3e-5f115fdec91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274261, "uuid": "53248af6-ff32-4da1-bc53-a47d2b2e4efa", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdcc706-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322396, "uuid": "3b43396d-4245-4ceb-9ba8-086289f8afd1", "comment": "Malware payload (Mirai)", "value": "5ebb27225ed9190b35d67f5edb9ee8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322396, "uuid": "9a26de20-5ee7-4b5b-b03a-8a18b373c4b3", "comment": "Malware payload (Mirai)", "value": "995454d195c6b61df3d89e3b04a3f4613e179f19193473dfd720386c6588c56b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322396, "uuid": "a6db43fd-f09a-4713-868e-b1d4fa834767", "comment": "Malware payload (Mirai)", "value": "74c7b6599d7550179649a8e87d4f0a33c5007391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322396, "uuid": "cfb3757a-c34b-4ca4-96f5-1c9773a18083", "comment": "Malware payload (Mirai)", "value": "1297991e3f39f78840adb5309edf075f8828ddd852fcd07209e6b1b781c895f28b6bfe3c344e1a087f51f3f2e98e26db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322396, "uuid": "bb2cbf8b-7431-4d0c-972b-16459fdcddfa", "value": "T1FD332B5BFCC1695BC5C01336A36EAA5E3721A3E9E2CF3703DE1C1B2036C660A5DA6D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322396, "uuid": "d1bd10b3-8486-4ac9-8d3f-1192be38afff", "value": "768:HljNltrmSkv494gHUccbk2gm63sO4hI/q2BWRyOvXMoAhAgNDBNodwqoO:VVmSkUN0Xw2gX3h8p2QRvvX4BqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322396, "uuid": "5686edc8-285e-47d5-8fe4-986f32efb12b", "value": 50660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322396, "uuid": "547223c9-ec89-422f-9240-ebbe759649cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322396, "uuid": "202ab44c-979c-419e-aeea-fde00c77b5e1", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0bcd78-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780346901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346901, "uuid": "c469b9c2-0e98-4f77-ba2e-0fc55c3b47ea", "comment": "Malware payload", "value": "f3e26857dee1394d2d4427e0bf8c2430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346901, "uuid": "c825a653-9d44-4a22-99a5-a579d571dcef", "comment": "Malware payload", "value": "99f6295c1ab9c9994e0b3293f014eb468872309e41e643b8204b1e14205ef451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346901, "uuid": "baa04f37-452d-4bfa-a9de-e7931bb468d2", "comment": "Malware payload", "value": "6f722e3b68f27dbb423a7f0c7a28fe42fdab38ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346901, "uuid": "697c8a0e-f2a1-4aeb-9ea1-981c0ad96c1b", "comment": "Malware payload", "value": "a248ee2807f58fcc6250006feaa283d530bc285e20b6d0e841c2f348af98d77dd03a67321c1ff2fb3f5c810a3e0a5297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346901, "uuid": "48267783-c9a4-4b59-9d5b-22029db98ca5", "value": "T13BC3FA46F8819B11D5C151B9FE0E124E77231B3CE2DE7212AD24AF747B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346901, "uuid": "47eef789-53ee-4b2d-8436-0fea1560cc90", "value": "3072:GBmOLrJADCyZsaLaVJx0+vnj3cYKAo0r:9DFCaLaVH0+nKATr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346901, "uuid": "213adb95-c4f1-4c13-a917-59651b49d3c7", "value": 125536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346901, "uuid": "3416cda9-f954-4b58-bf3d-6ddc8fec2cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346901, "uuid": "277518d0-4d29-441c-b73e-65f965c1fded", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc473581-5d57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780276682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276682, "uuid": "cc6d9bec-fe7f-44d8-b9c9-993d6b7699e8", "comment": "Malware payload (Mirai)", "value": "67dd3e9741e866a55c510838bf8bcb01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276682, "uuid": "e45de613-9fd5-4638-a7e1-51947a311e30", "comment": "Malware payload (Mirai)", "value": "9a4b15046843e0d21e94dfa3f287889034b12536b42eb7bbf304abadae00bae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276682, "uuid": "e1618356-32f4-4d90-bb03-e9ce9a0c32f4", "comment": "Malware payload (Mirai)", "value": "89d45adbf526dbb1aba4d0493617c371a02a6f27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276682, "uuid": "188c365c-2b30-4e79-abf5-6ce1c5dabcc5", "comment": "Malware payload (Mirai)", "value": "a4dc587f3d60d2bd04aac191df8ac78a8df7568cb321dfb9a370b4bce72ef0d746dd1338d6f74a17efb34f5bc4032b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276682, "uuid": "cbcce05f-1d4b-4dd9-9709-ae3e4cf1d93e", "value": "T1FE565A46BC1E7463D6C979712F6612943238BC49AF81D3236618BB3DFAF2764CB13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276682, "uuid": "897b2fcb-0883-46fd-bdac-938513ebc506", "value": "49152:3HFvH0pXLQJz7XWkT2Mk95fKoA2xprrRy6NTxQzR+CKibBD5E7:3HFvH0p7QV7vT3oAqpkRPKwrE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780276682, "uuid": "06434ef8-255d-4b1f-af79-a75f8529dab8", "value": 6291618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780276682, "uuid": "f5a5745e-4d17-4c96-84c9-5ea6d3b9d9e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276682, "uuid": "c4502f02-5ffc-4998-89c9-13c109bd14c3", "value": "9a4b15046843e0d21e94dfa3f287889034b12536b42eb7bbf304abadae00bae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4285cfa8-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "be481b80-fc02-490f-8616-b796239326c6", "comment": "Malware payload (Mirai)", "value": "25ca9d65adde57bb3edea09c0ed1c5c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "717aca3b-6005-4eb6-9379-2f30add32895", "comment": "Malware payload (Mirai)", "value": "9b27c821cf315ec4ac65b24380dfe6507e8160a82ed62ea7876038aed353e970", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "b6221db5-57a3-47be-8eb2-76a207878425", "comment": "Malware payload (Mirai)", "value": "e084d9cea8efc02319efd48b0cdb92e493aa9caa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291510, "uuid": "70dd58ea-2285-4e0a-8da1-3c61dc0d8b06", "comment": "Malware payload (Mirai)", "value": "864ec8096abbf12220972d7150df2c5a56d5c39ec0597e64c1113e17f98f88b977940d0392198d68aa4bc5f2be39fb81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "62e8ce93-0d21-49a6-9368-facb580f5448", "value": "T1FDA35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "71e11620-215e-4dbe-a837-018183861f32", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qkr/a:ip3PSVWxHcqRhzhNPt8Qkr/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291510, "uuid": "a2d2f7f0-023d-43bd-a169-65bd9938f30a", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291510, "uuid": "02528d91-d14a-4d70-81aa-e73ac4d218a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291510, "uuid": "1cf76fbb-dbe1-4d0c-92c2-e82ee548dde7", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91c3563-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780347141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347141, "uuid": "a98bcf0f-ba6e-4bfc-86ef-3d172b4ab398", "comment": "Malware payload (AgentTesla)", "value": "eaf95dd93131477697c0e49ba5c23a69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347141, "uuid": "2280c124-a27d-46cc-b700-645f3846a449", "comment": "Malware payload (AgentTesla)", "value": "9c01cfdbe35631129e75e76565294dadc83d2264f3b979ec1afa2d0d0eaac514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347141, "uuid": "ae399446-58f3-4393-8db8-ecd0c7d0c67f", "comment": "Malware payload (AgentTesla)", "value": "58fb867d4d325075fbc5e5ff7b2e02fd97e8b7f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347141, "uuid": "e55c034c-1dd4-4bb9-99e0-324a85193fdf", "comment": "Malware payload (AgentTesla)", "value": "aaa0215baa3acc04f4246010b4765d359716ca6f2aa7fa57be5c915d074728271eca581c9587af80de8c00c917526999", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347141, "uuid": "0bf9cbb0-a85a-411e-9da5-90fa60ae52c1", "value": "T14035DF226E832F68FA391F3C800214686BF4D8525226E75FBFFC91A51EA7F45CD27605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347141, "uuid": "301b9b7f-e7d1-4fd4-a05d-471c9eeac381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347141, "uuid": "74462a47-b226-4dad-a61c-11fc9430ac0b", "value": "24576:87lD3j4+ugZU/FHGtYINStGFt2CHEQCvoGF+YV:8pduWU/hGtNNStGF0CHOvvF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780347141, "uuid": "7ff74700-6cf9-4b63-8226-c53e01b7557c", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780347141, "uuid": "cf062818-9bcf-4b9c-b927-a40b0df3136e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347141, "uuid": "b29276bf-5d08-41f3-82b6-a85215586540", "value": "copia del pago anticipado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defb30bc-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "fbd9b1e9-5bb0-4cb3-b3de-c58b86ccfa43", "comment": "Malware payload (Mirai)", "value": "a2a8cc2a0d1a1d8a1ef2c332f48236bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "6640416a-2d95-4d76-99e3-9b67cead772b", "comment": "Malware payload (Mirai)", "value": "9c98c5301e877b2105c86e2f5de78a8a575947e72b0f5862e2321c6ddeb4745a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "8f01294e-bdb3-433f-bce7-68a295c891ed", "comment": "Malware payload (Mirai)", "value": "d9b76ebe9556575ae9a4bd01e8870c2f296311d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "cb59cea0-e201-444b-ae54-cb61959fdf6a", "comment": "Malware payload (Mirai)", "value": "5f36e0da613453e5bf206659683151769cc8f67e1d39489f16a311da209bb4aae6b8450a52b897a62149b89f4b6c9d48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "9246bc54-612c-4f28-9ea2-c0772f216fd7", "value": "T19526286DFC0DE452EEC863746BA187D232397C84CF42D6136221FA6EB5F73949E52122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "44ce4767-ebae-4c6c-8506-d36e598e6c25", "value": "24576:GL9aBkFeereoGtZb4hcp9scEZJn77TBWJYvifAOXEletssv+tXk59yjy/7j7rfLH:GoBSrApvYKrkosgT5EcT8+I/0JQB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323556, "uuid": "8904aa4e-67bd-4f46-acef-19fde7f9b219", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323556, "uuid": "76388259-55cf-4f52-8f93-cb32b9c3975c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "a64f2e2c-5bf4-4c0f-a8aa-3e37a97e7156", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c59350f-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "a774bf75-5a51-4a0a-8602-95a3d7ef4b49", "comment": "Malware payload (Mirai)", "value": "893fb02d66f912fbb52d493e5a18f1e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "1deaba97-3c1b-4e4c-9c25-64c365f582be", "comment": "Malware payload (Mirai)", "value": "9d26dcf70cbfdb821befbcbbf65838c88a380196b2f2371d80d8514e3d3dc7d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "38655699-b57f-4898-8511-401df1ba01b2", "comment": "Malware payload (Mirai)", "value": "e57e8e49cabf628b33fdcef8fbb083de93ad4e2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292896, "uuid": "d60381b7-2441-4d50-a874-94a811a929a4", "comment": "Malware payload (Mirai)", "value": "e7deb6620e9159fb4aeaaf2a95a652d99ff922a35c4ec2d501cd009d9e37dc7ee952cc2d93a1ba8521319d72c56ec7d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "634b74fa-7609-441b-a727-fbb5cd4700f6", "value": "T19B63E692FA819D51C9D938BAFA1F81DC3343072CC7FD3506DE11AB2165DF5AA4E3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "ebd8a7a8-c5cd-486d-8dae-d08ee2351f5b", "value": "768:WCErN8djzdBKCyaoz9UuurnN5PDpHwD1GLtLbRdTzheqh40PH33hlb+ondTiSk2g:6rN8RGCVo9kpBdHwhinRAqXj+o6WB67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292896, "uuid": "4df69c28-8940-41fd-9126-64512690f0a7", "value": 68924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292896, "uuid": "7bb908ba-45df-4264-81ee-1f5f31ef6e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292896, "uuid": "c70fb5fb-97c7-4a45-8909-a85177137f16", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20721075-5d8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780299184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299184, "uuid": "9823ca46-c3db-447a-b9ae-35394198b19c", "comment": "Malware payload", "value": "2b50eb57ed83f28ca6e194c48302ff22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299184, "uuid": "105cd493-54b1-419a-bf91-e637a68486e3", "comment": "Malware payload", "value": "9da788962328d9e5c2ec3690c4b672284e1702d42fe4fbec4c06182f64871cf4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299184, "uuid": "53e86b8c-759a-4668-a18a-42ece0cf18a0", "comment": "Malware payload", "value": "27c4b5698b08dcd6668fb26f3c01798486fe5a37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299184, "uuid": "b97f1852-5c69-41f0-9a06-11059bfcfd0b", "comment": "Malware payload", "value": "07014984ee9a8b215cedec324a5fb46d5cb33358bc12a548580a967899c5f13c95aa2aa8279b9df7ed1842bf8684cb7d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299184, "uuid": "5dc5e8a6-b397-4764-8f67-401d3df3bfe0", "value": "T18214B53EA6A24CB8C9A38278FBC7E4B04839BC594525F06F07CAC6113D4FD649B6DB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299184, "uuid": "61145a97-e600-4b4a-a3cb-cf72e4a906de", "value": "37e27e9c2430dee474347e4e82ffb54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299184, "uuid": "90f2ea10-eafc-404d-92bb-5a1f973585e6", "value": "6144:Qjvj6j1nH2rT1dTI6Jt+/KCEjfQMwJpStmJq:k4x2Hi/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299184, "uuid": "61561436-e810-4a34-b9c1-4a5c31238a48", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299184, "uuid": "73b9b15e-a922-4dd1-9a47-fee140899a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299184, "uuid": "51e913ce-c1ef-49f6-9200-9feb0be95457", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb4cfb5-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278163, "uuid": "59c42a4c-3a36-4f2e-a6a4-59aeab2bfacf", "comment": "Malware payload (Mirai)", "value": "1cc11cf1a65f6471490300bd4dcc8808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278163, "uuid": "5091c2bb-9de1-4515-a4cc-029ba97b0472", "comment": "Malware payload (Mirai)", "value": "9dc99ec709f9c03f4f312a734299db994d9a2600f4c63c02db41ac25137843af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278163, "uuid": "77d8eb24-5ba8-4531-8e8f-741dcbe0536a", "comment": "Malware payload (Mirai)", "value": "7c90fb1253bd9db0b682c0ee4bb39f9ccec21515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278163, "uuid": "840b0c9f-c34a-47e7-99bf-6e230fdd00ad", "comment": "Malware payload (Mirai)", "value": "ae43561386ebd811fce11379a94ca63a8686d59f00760b438ae910abc187058ed1bd8443b79d4c25a690e42412974555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278163, "uuid": "38e111bd-9ff3-4321-85c4-648bc617d547", "value": "T1495329C2C253D6F1DC1265B02477A731AE75A4366A35F646E3EA3B36A803B41AA0735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278163, "uuid": "08b9fc4e-78be-4c39-b22f-0554e147f556", "value": "1536:4Ft5tnfKcYZMwqeMxR+TGgASK/+ZQOnfet1Pb2CLZq:4Ft5tnfKcYZMwqeMxR+TGgASKGOOmt1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278163, "uuid": "e582af24-dae2-4b69-9121-dd238d19956c", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278163, "uuid": "ce0e08d3-da40-4483-a072-a15184e495f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278163, "uuid": "925d5c2f-d652-4ddd-852c-0b8dd2e5420e", "value": "9dc99ec709f9c03f4f312a734299db994d9a2600f4c63c02db41ac25137843af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ec3eee-5d73-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780288728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288728, "uuid": "c476d21d-0bb1-47c6-8621-7cc94a29c695", "comment": "Malware payload (Prometei)", "value": "a9aa328d2adc963b00a161408e442283", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288728, "uuid": "ae2048af-feda-4890-a2de-4cc6f95aa1e7", "comment": "Malware payload (Prometei)", "value": "9f919c03bcf59a2112d374012505cbad5ae9d598b86b238c66d37ca301de7fcf", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288728, "uuid": "b1df7602-f6ff-4244-ad37-81fc3969503b", "comment": "Malware payload (Prometei)", "value": "28159cff50d24b783baea2d45c3db89dc6d55d4e", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288728, "uuid": "c025bbb9-5784-4b7b-bd5a-3c3c48c91e80", "comment": "Malware payload (Prometei)", "value": "a9d5cf5d81f55ace26a8829c96a1cc5f016c3cb4d448576a74fd627f379f18540b555e8c383d8b97b079d8aaabe42a63", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288728, "uuid": "e864b405-a9b1-4562-9a1a-adb9ddddb3c5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288728, "uuid": "89fcb826-40a2-41e5-96b6-fd1ed341bcd4", "value": "3:B55HX:f53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780288728, "uuid": "1f908054-d8c6-4877-891d-0320b7dcbaa6", "value": 11, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780288728, "uuid": "f5b64371-4b08-4259-b929-308e603af08a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288728, "uuid": "e64a2fcf-6cc0-48ff-88b1-b822c5d87642", "value": "9f919c03bcf59a2112d374012505cbad5ae9d598b86b238c66d37ca301de7fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd900c3b-5d8b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780299018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299018, "uuid": "481f2157-6e68-4cd1-abc3-0cdc251e821a", "comment": "Malware payload (ConnectWise)", "value": "961c70410c37dd6290115cea3020fcae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299018, "uuid": "351d2361-c1e9-4379-95ee-b9f040061bfb", "comment": "Malware payload (ConnectWise)", "value": "9f9a91f3c4b9e40e090f1075e2483dd90ab041f18bcc8b15b2d57fb244b0a0cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299018, "uuid": "794b7388-2fc0-4300-82d3-c72829a3d4ec", "comment": "Malware payload (ConnectWise)", "value": "6a01d86696ecde3cb0d6471c0c5bac985ce9e91c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299018, "uuid": "2649a537-6bc5-4c9c-9040-b5472ca9933c", "comment": "Malware payload (ConnectWise)", "value": "2f399036b095fdab4ac0d1f5618cef68e4513c92f2c29d6c8fd2348f61408e22e76dc4e2262db660edad076d7d26054e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299018, "uuid": "cd55f9c7-af9b-4b84-bffc-7745ec166892", "value": "T10346E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299018, "uuid": "02887c26-58f0-4984-854a-2a829dc5f69c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299018, "uuid": "177ef6d4-29e4-4451-bca5-125f3ac7f976", "value": "49152:LEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMX:kEs6efPNwJ4t1h0cG5FGJRPxow8OFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299018, "uuid": "3679b6b2-55ae-468d-b991-e730d97fede4", "value": 5673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299018, "uuid": "0846eb8f-7850-4603-abeb-e22c9a7425dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299018, "uuid": "71e1ca17-aa9a-450b-999f-d3f9f8f592af", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc4b9c1-5df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780342186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342186, "uuid": "a76d21b1-ed98-466a-a986-52b2309dd305", "comment": "Malware payload", "value": "28719fa8d6295c21c7958ca1bbae2462", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342186, "uuid": "599b69ad-9c70-4473-a119-5d9f02f814d6", "comment": "Malware payload", "value": "a043a0f20a4bf6ca46ee564f21dc535636060c32efe057ed7df7712da2177acf", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342186, "uuid": "e6b3bdfb-271c-4d37-a7e6-3bfee4b5def1", "comment": "Malware payload", "value": "7429f065e94f008a20abe646421fdd4b92942e15", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342186, "uuid": "16b92489-a03f-48d3-aa3d-2714c7bb8347", "comment": "Malware payload", "value": "36e908b53f80be7c64b4c30315c2a209e35ecd6afe2954ab3b6a895cfa6e94fbc1fa9c67c87ef02c669de2aa104d4771", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342186, "uuid": "3a84440e-7c2e-4aeb-b908-8ab8a7357130", "value": "T1E34165B1E818A4C4C27AE5279667FEA9BA362097DC4E14E901ED13290E033D8ADD3C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342186, "uuid": "49259c3a-fea4-4787-9911-c593831300b0", "value": "48:MpW0EZ0qois9XSaGDdAgARNECqQtXRa1ZqBc8SpHgtE/PGNOIuW:t9Z3shSHdA3NEhEa6c8bt6PXIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780342186, "uuid": "f08c1d52-4141-429d-a145-71c6db0ee021", "value": 2179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780342186, "uuid": "ec7b10e0-11b9-46ff-9aba-b8817b1b3d68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342186, "uuid": "14f760b2-01c5-4d3d-9c6c-9cb610713983", "value": "sample.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd6cc81-5da8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780311451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311451, "uuid": "540592e2-2ca3-4d85-9ebc-a521e4b1ea31", "comment": "Malware payload (Formbook)", "value": "512af6bc53d694b0bf48b3a53b7f9335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311451, "uuid": "41a00033-b6c8-486e-9bbf-9db787d474e3", "comment": "Malware payload (Formbook)", "value": "a0becef9ec77a898adf1574d9f9d11abd6a0bf190a2edb071603598ecee97344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311451, "uuid": "4549d028-0fde-4bd7-9ed4-f2f9da6106c4", "comment": "Malware payload (Formbook)", "value": "c654406f1c2f9d0ecd24805a322ff12c0d916e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311451, "uuid": "4b8055f3-f15d-4799-8140-9ec43089f379", "comment": "Malware payload (Formbook)", "value": "69653b842114bf57d280f9e876334e936ece791df5f0f136193fafec1549df7b8c0318eebe44f16c3c27807740f61d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311451, "uuid": "0eb4075e-5082-4690-936b-640132431858", "value": "T123350144A358DC01D8BE0B7845A1D67207F84F09A512E32A9FD8FDEB3C767665E2B183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311451, "uuid": "b4b87782-4a43-41e1-9af9-324ab5cc26b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311451, "uuid": "78d22bb6-bd73-4cdd-a98b-9233a653bc88", "value": "24576:J+U8+g25ayskLuENqGgxYKLtdDNU2KBR4QwYFUCnmqBV9jFhxYsPHm:wUdhkyrLVTg+grNU2GjAq3JFhV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311451, "uuid": "04fc2ac7-a7ca-46a0-9e46-2d450458535c", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311451, "uuid": "30e7f91f-38a1-46b7-8dc2-df6d7251de54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311451, "uuid": "c6270a31-3b91-44d8-88b1-345612efa9c9", "value": "Payment Advice Ref[M1OnY0ExN02A_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a27813-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "b9075b4d-f2d6-4b93-a992-8ff004abdd6d", "comment": "Malware payload (Mirai)", "value": "6b769847bc30717fc8477dcabd338fae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "8255e7f9-7e90-4dab-ab61-30109d14af2e", "comment": "Malware payload (Mirai)", "value": "a1ee483ee874b04aff9c60a33118f8c49e23d09452393861ca08ce77c0e9e99b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "da935e6f-6a4c-49cc-b406-244c4ce8b57b", "comment": "Malware payload (Mirai)", "value": "7c14d123692ee21a6df1ebff51e49848c47fdcd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292178, "uuid": "8f69336e-d776-4132-b827-c737715e8441", "comment": "Malware payload (Mirai)", "value": "c1b543bb5acec7dc166dd1abecf5034d72ec059fb1c3768cc4599700ef033236dddb7abacd2db88e81c08eb53cb91011", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "37ebb3d1-2426-43ad-a27a-2b87ae8a03f3", "value": "T1ED357D2AF2B3B0BCD017C03053AFDBA2A835F47912216D7B35C496352D66DA01B69F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "6de543c8-97fa-47af-8985-a30ade83af55", "value": "12288:U39v0uT0xHYTnCFVzuQrZW59EnMt8FPtD0myI/pUxi5k:U310uT0x4nCFVqQrqCMt83hpUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292178, "uuid": "2c3cd59a-8008-462c-bf81-ed0f38a5fd16", "value": 1070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292178, "uuid": "3eddcb58-eb43-45dc-9ede-7abc0716c1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292178, "uuid": "33956d7f-87b6-497c-b70e-42cf28a61e5c", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782b9b99-5dc7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780324672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780324672, "uuid": "61fbcb33-d70c-4ff1-8d35-0117cc727fdd", "comment": "Malware payload", "value": "feaff15aa4cfd3071dd81c9e8057a522", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780324672, "uuid": "bf52f37f-81e0-49bb-a42b-677a44f4e046", "comment": "Malware payload", "value": "a29ebc81222a2f96c1730fed9a9cfb5d9e24a1051a5b2b5eb358415d43c05829", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780324672, "uuid": "46b5c1f8-1f8b-4ddc-b405-4755c5f1d190", "comment": "Malware payload", "value": "2c69da9a24f9da58532bbb309930011890a95b36", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780324672, "uuid": "f473314f-6af6-4726-b02c-96605e5f2279", "comment": "Malware payload", "value": "22f218ffa00400e86f42f1dccb54d1820c05bb46ef3e692b522c54ec5a49f1bc04990a1542b9f48c428e3cd40b00357b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780324672, "uuid": "dff4d498-35c3-4330-acd8-c199717742dc", "value": "T16F18CF16B3954EE3F026C930CB658233EAB07C619135D39F3266F3161F3BA914E9A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780324672, "uuid": "ba11e52a-f3f5-4984-a390-15951d2db96e", "value": "d8a4cf06f95d79130965186f8db9060c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780324672, "uuid": "3fe73a20-f334-4638-b4e3-63f9c710a084", "value": "786432:6Sz3sfJxTlgHjBfO8HCkPU8h8y51pCEa5PDtS2elEdsC3NYRh4KlpHN63In5SaeZ:6Sz3Kg1V8vLt9ME3khA3xXujHsFCRNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780324672, "uuid": "f96e91e7-2be5-4f71-a9a6-b97237b45847", "value": 92467712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780324672, "uuid": "17b5c678-3b8b-4636-a32a-3304bd437106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780324672, "uuid": "faef4183-aaa2-4ca9-abb5-a10381fbb2fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60e15f2-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297690, "uuid": "a27189bb-a5fd-42f9-9e23-128981f8e12e", "comment": "Malware payload (ConnectWise)", "value": "90089f0d7b0a56e8173f80d8bcb4a44f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297690, "uuid": "80f2cbb1-04f8-4c6b-9fae-9df8a4fcbcb8", "comment": "Malware payload (ConnectWise)", "value": "a36343519ee4106740c898d9d00a719dc37f558ca60377264b1eb234a5c71b2f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297690, "uuid": "7e6c7cdc-9927-45a6-a4eb-271f74100670", "comment": "Malware payload (ConnectWise)", "value": "efd0a95406c5b1125751b791a7a45c2af61cd84b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297690, "uuid": "0bd8e40a-b279-4cd4-ad50-2aefb53619eb", "comment": "Malware payload (ConnectWise)", "value": "32b617b164cc6027bffaee1701b9902ad9af7b6a18d39dbea7eef6423472fc019ea918e68abdfc0a4f7d7ae6b21d252c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297690, "uuid": "1c553ad9-3fe0-4446-9067-7baa17ecbd8f", "value": "T1E146E101B3D695B6D1BF0638D87A52696774BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297690, "uuid": "c144a6ba-7eeb-41de-ae02-01b3e2576b1f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297690, "uuid": "bf4d78ea-1c92-4fb0-882a-c81e863354b8", "value": "98304:LzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:LhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297690, "uuid": "34401269-50e9-4260-819b-413b7c37b562", "value": 5664264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297690, "uuid": "5a72941c-5bbf-4dd9-8fe4-9b8e930acf1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297690, "uuid": "b322bfeb-0b88-4b84-8de2-89733a988004", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7daa3f7-5de8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780338925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338925, "uuid": "3943ec92-360b-40fa-9ae4-551a4ca9d8fd", "comment": "Malware payload (Mirai)", "value": "1661b40ca8c0639be97f60f35d98197b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338925, "uuid": "468409ad-a30d-4a4a-8e22-98aac7116b58", "comment": "Malware payload (Mirai)", "value": "a3ad425a8498ca321d0515396afcfff0a55988ee96d667a9263d2fe31f97bcf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338925, "uuid": "8a7ebb8e-030d-4ff6-9b71-6d214ba4c3b2", "comment": "Malware payload (Mirai)", "value": "cc583272e7b9e5baf727cd097acbdb6c9bf6fefe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338925, "uuid": "90e0e7b8-bd0c-455c-a3c5-8920f9cf8321", "comment": "Malware payload (Mirai)", "value": "7a79891574dd2e2394b0a3ef3d12719b48f6a998e7ad5e92d9b9aac77fdc407c553b0a3fb309d4bfca9faeb867ba5e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338925, "uuid": "a41c2557-278f-4d9e-a43a-90f12f260f67", "value": "T1F4E33B46E6408A13C0D6177AB6DF42453323AB64D3EB73059928BFF43F8679E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338925, "uuid": "45eed5c0-58ce-452e-be64-b099fb592f97", "value": "3072:VZufEJeKa7H3/pMf8/cCpcW79a8Zu9dL1JuM/9oRS:VZudKa7H3/pMftCp788sHL1UM/9US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780338925, "uuid": "668c1dd2-bfb4-460f-99aa-45a13c89ce04", "value": 155503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780338925, "uuid": "d83ba7a4-4a1d-440d-851a-8bf98d9ed2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338925, "uuid": "6b0b33c1-ee48-4fa6-89b8-4531a2c96f7f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918b3343-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "0ccb5d46-7413-4a8d-a13c-a26b17c44fb7", "comment": "Malware payload (Mirai)", "value": "fe12fb3ffcfc8d6730746fbd1cfe323a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "4df6f9ea-ed9f-46af-a51c-309d04c47f1e", "comment": "Malware payload (Mirai)", "value": "a530127002312ba243ec22ed44b0c217adefbd21e73b1dd4b09d2c63fda6555c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "e928f9e8-4a49-4253-a051-6241970a57ed", "comment": "Malware payload (Mirai)", "value": "6e324d5e441a522acd2ab77d7dc2b66eb0b3722e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "a27714f3-7b27-4c99-9e8f-b2c3f0eda6a5", "comment": "Malware payload (Mirai)", "value": "2526e106d99aa717463ed3f9cb05f5ab44d9c89642da07d8080455d80d43e0afed9d08bc6954dd7f47bd8d1465ddbaa0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "ab9cf1be-b541-43a8-b246-c01f13dd79f7", "value": "T139A36BB3CCAA6F28C625D1B5B0708F792B63AE1481475FAE5567C3748443D8DFA063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "20554429-4f78-4318-9897-42782876020a", "value": "1536:1oFbMftrCyoKtqIH7EUrmF7pL9ffnWCbdLcNXN2c4N:1oFstr9PtH3mF7V9/WCdLANO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292931, "uuid": "ceab8e2f-7367-4010-bb30-799fb112b9ad", "value": 105152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292931, "uuid": "cfd70d34-59b9-400d-afc3-5095c492a7a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "2276c345-c654-4374-a7c8-0c6c57ca6630", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d52bba-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322378, "uuid": "345c68df-ab22-4e1c-bd14-a9ce9ebd8157", "comment": "Malware payload (Mirai)", "value": "73f6fb2fabb0412c93018cacacec2728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322378, "uuid": "d4076c4a-17be-464d-af47-821fb7383f18", "comment": "Malware payload (Mirai)", "value": "a5a96f13b21e1bea303056fccea936586ac6d581b1d1b66481e5d48566a88bac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322378, "uuid": "f5fc4f60-c466-4ef2-a4ad-fc6d41935b5d", "comment": "Malware payload (Mirai)", "value": "3cedd73557c63d39cf31eab0dab61e598b83c74c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322378, "uuid": "98911be9-5043-44a3-a749-04a8855bdb93", "comment": "Malware payload (Mirai)", "value": "69264d6e9a223a8e12418d405b234723dd7afb10b4e74000f5a55787f6dbab5f955de6356580263507d688559f22bfb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322378, "uuid": "67d60d77-2c6c-4c36-b0f9-67ec4034f990", "value": "T105834B5AFC815A13C5C1537BFB5E428D3B2213E8E2DA32039E295F6133C791B0E6B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322378, "uuid": "4727ce0a-619b-4555-a5a2-89d8f0814dd0", "value": "1536:HhkaC4QVKaPIn503QIhpeIela6nNc8NV8MwNIllC+vi9/:HhkdVwweLNcShLC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322378, "uuid": "14a41d4f-85d4-40ca-8bb1-f530f5f6d26b", "value": 87360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322378, "uuid": "70839556-0831-4896-a38a-c2ad7da2f0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322378, "uuid": "e766b790-3862-4a48-a599-3f989a58ebe1", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735208dc-5df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780342702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342702, "uuid": "c23affdd-3426-4cc1-a87d-65739e0be8c5", "comment": "Malware payload", "value": "641198b00083ba4fa5c1c0d6d0d24084", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342702, "uuid": "1df84483-5716-495f-8596-57c849d20ca4", "comment": "Malware payload", "value": "a5b6255d7858a0e175ecf03239e7f977658037cfb954af5af319a7e83ff2eeaf", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342702, "uuid": "f6bed8a4-0225-4713-888c-80150f2adf83", "comment": "Malware payload", "value": "89f5f48c8dcfee85c438d16bbf2f308342601d4f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780342702, "uuid": "b2c81267-3767-46f0-926e-3677fd158a4d", "comment": "Malware payload", "value": "b00bdafb6f1856d6ba6ee7150af5eeb1cfc7be44453d3748c3b5836c5fad60a4292457d2cebedb560fea225beadd333b", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342702, "uuid": "e42a88dd-34aa-4eda-b0c0-6e57fdf0f4fa", "value": "T1B6173787B853F2A0D854B2F3346381757768BC253B7493F76ACD25B61B321C40AE6E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342702, "uuid": "07006ea6-4895-4250-bbc0-10058e425de7", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342702, "uuid": "20fdbf19-2425-4300-8a2e-bf972a6b113d", "value": "49152:McMXSC4SYs3w0DKX9yaqraU7RlQ/kYXimzM16P8ugDUV+5K1B:RC4Sd39wyG6mzFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780342702, "uuid": "e2c2f4f3-8f30-4ca7-a598-65f090f22a88", "value": 19549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780342702, "uuid": "1076dc94-13a8-4799-845a-4bf879a7bf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780342702, "uuid": "dcb18c04-f161-45f0-beba-7c7671c4e579", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441a20f8-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "0dd21bbd-e624-4b96-9f5e-4eeafa8d5e9f", "comment": "Malware payload (Mirai)", "value": "0d41565ee1c726f310435008bb9cfd74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "c070e85c-7855-4c85-b0d6-d3c55e2a401a", "comment": "Malware payload (Mirai)", "value": "a5d656327bdd3c5b0a3d4ea9de87a898ff7b9d98038b79e7c4656c846ab2742a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "326499aa-2802-487a-a7f6-d909c870d85b", "comment": "Malware payload (Mirai)", "value": "226c0df9cff56c76347d497927ce040b9ae8a09b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291513, "uuid": "86b0a2ed-fb80-499c-a945-5bfd3f7fc4b3", "comment": "Malware payload (Mirai)", "value": "dc7bf5554583c3e541f8d93133b81cbf541d013065407a5d2daede36ec4c6b5ce6034ff482f26cacc89a2851a6c6fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "45d6ab88-8121-43b2-8b7a-4382f4f3e781", "value": "T1EC635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "9e119755-7539-4bcc-ac30-e5f694dbdad5", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPux:zGYxpTGASC4XTfyyLpIoYPsPux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291513, "uuid": "b604b8d1-5c64-42a3-b84f-4208cef24e07", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291513, "uuid": "0e42a31a-2077-40a9-9b56-b6504f8738fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291513, "uuid": "f8523eb5-bbbb-4dc1-935d-7388942717e0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a917e81-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322394, "uuid": "ab0849a5-b8a6-4eab-bb05-9721f68fb0e1", "comment": "Malware payload (Mirai)", "value": "0b6f473132e071c44faa6305e9855987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322394, "uuid": "1e5deed8-2309-47b8-abd6-4e9e240d276a", "comment": "Malware payload (Mirai)", "value": "a6181e6d7515d04c7536790a3d0089f99fe794b44ca78254f90a5fb568d2f192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322394, "uuid": "e31af0e8-822f-4702-aed1-6e1fab32cb85", "comment": "Malware payload (Mirai)", "value": "2b3ff095828fe96f5d538ba490f70ff5d768baa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322394, "uuid": "600e299a-71c0-4986-9ff6-e2e7f9b84ec1", "comment": "Malware payload (Mirai)", "value": "9d5fb7c047d5c0fa24ab194b882ff77c1efcfcd9c1d5cb0d2d3eea0336e109b041d41cbe9c884d145196e333db068e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322394, "uuid": "5117fd82-c608-415a-b7e6-0b3ae372d791", "value": "T168834A84FA83C1F6D057083051AABB3FDB31D9E960B1D759EF96AF31CE33601A212659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322394, "uuid": "cb603e5f-3128-4237-8b30-8282a6e24ec4", "value": "1536:7XpT3Xdp1UJU+qwpCtlrPlxtvIIJvKJzW24LW1x7Rig2VR0Ukz:7XpT3Xdp1GU+qwwlrPlxtNJbDLW1xFio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322394, "uuid": "e8772e99-f8da-468e-bea4-a71f78184c38", "value": 83028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322394, "uuid": "867dc8b0-f79a-41e8-859b-afb658d20929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322394, "uuid": "ed0729cb-069a-440a-b31d-71ac11a9496d", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f145d751-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "49c136ea-97af-446d-bd3b-7a95c1bdfac0", "comment": "Malware payload (Mirai)", "value": "8ac82d956792d43f7ba0aaa81deae4ad", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "29b1f92a-ed90-4c3f-94fb-9f671aee3a90", "comment": "Malware payload (Mirai)", "value": "a62aec28976c304c595f91ce15f4d18198aaf663d9175e6a95002955218b9db6", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "ba0e0241-9c26-4602-9468-b52e5950f202", "comment": "Malware payload (Mirai)", "value": "9f5e534d271c4e5d6636d88e31597b865add949b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "60639354-d9f0-4c5c-9624-b22d7d4950ba", "comment": "Malware payload (Mirai)", "value": "f7286c94a3cf4b6c247750eabd524add31aadf85c7d6c2d05351ab03330371ca20ed1469d90ac36ab0b9e3cbc8a57da7", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "2c0845b0-fd16-4685-9109-27fa60a8696c", "value": "T16B762711FE8B50F2E9034D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "650b4029-f037-4bea-a3eb-7bbbc198b9ab", "value": "49152:vNBjP2hUIgFmCn7phTo9SDW1pBD4PvOCz2ADADtxKRg3cTD8LJvAUDtEvmCLp55G:1ghjcpBo9SnXOA7DixKmNTFwEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293522, "uuid": "3f8793b3-7a6e-4fb7-b164-74cf90512c12", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293522, "uuid": "967b56a9-386b-4ed5-9f8b-14631ef1041c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "58b4d2d9-0fe7-46d5-9f2b-cea68bcf3d61", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a790ed-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322337, "uuid": "ef6ec745-1bdf-4c43-a5a7-cce2cf303fdb", "comment": "Malware payload (Mirai)", "value": "8d6df811087acbc2d36a31d032ac8b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322337, "uuid": "ffe10033-e856-4649-9cb7-d9965010003c", "comment": "Malware payload (Mirai)", "value": "a67b72908b793a7021c9bd3820395a4765dd17db45e2f75e20e89fcb407f1f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322337, "uuid": "da8015dc-0ab7-4203-8f2c-f59ac2b882a3", "comment": "Malware payload (Mirai)", "value": "d5b7493b54881aa42529c99ac55c0bbfa2def452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322337, "uuid": "c3f7f1fd-5b6c-4f47-adea-4b70c069e5a0", "comment": "Malware payload (Mirai)", "value": "c0496e58f9c8bd918b2706addf109d3b8d0c2885c907cb4c7259640e54dfdfbbb554fbafd72a5a47ceeb45caf61ad7f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322337, "uuid": "773ba8c2-b914-4746-85b1-08355ada997b", "value": "T1D903E1CA229ABEB6C024413355566264FE62CD07EF933EAF41A8B3EC497B56616609C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322337, "uuid": "e38a8e47-39e6-4bca-8a6e-e21d676f5d7e", "value": "768:t0LnTMKtgl0IlP1Nm6Q7/b/P6gHxQQ2hjpPu85P7jyx07t:1KCl0hx/D3mHSKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322337, "uuid": "cd85424d-a05f-465a-8dd7-c1cd9949dabc", "value": 40212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322337, "uuid": "712037a7-70cf-49f5-9231-f895b015eaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322337, "uuid": "48fe0e42-65ad-4c7a-87a2-c9b6c8cfdeee", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a6cd14-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292393, "uuid": "930fa80b-d750-4683-9833-7f01c8755911", "comment": "Malware payload (Mirai)", "value": "ea5bc658685ddb6c89ceccb5087a597a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292393, "uuid": "3e0eadc6-ee1f-46d2-90af-1aa09796fb73", "comment": "Malware payload (Mirai)", "value": "a68c6e9789d499c9af012af1c866f051bb50b34691cf5abe97c98adc687354a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292393, "uuid": "c954293b-7b02-4feb-a6e8-5f263e9a2979", "comment": "Malware payload (Mirai)", "value": "83b199eed334903f3ae0b4f080b92121e7310e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292393, "uuid": "6558a877-09e1-424c-b1a2-2b139ef199de", "comment": "Malware payload (Mirai)", "value": "55f30c209b5bf2977825fa9376c9cbc0255b6ebc055b56278afd68c0bd7759da109a9601b7097439927fb0e05098a074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292393, "uuid": "53653872-421d-4f1c-a7bf-47775bce69a1", "value": "T113C3C70E7E219F7DFBA9823447B78E26925833D627E1C585D1ACE6012D7024E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292393, "uuid": "6d5149f6-67e5-4a44-95f6-16523ec4311c", "value": "1536:4jg+2NyqmTQxlW+vly2rQ1gQGBFQTULjwBv5IaE+Z1ICez/P/za3:AIoz27skiAQTULjwjIabZ1I1P/zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292393, "uuid": "a2991936-2067-4f06-a9db-0300d769ccb7", "value": 126416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292393, "uuid": "94b2f3e5-5ba9-40b6-872c-b6ab89de6fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292393, "uuid": "3fe7ccbd-d418-4e72-aa9a-2407c0987cad", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b36d90-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322332, "uuid": "3790b800-c9c8-44c8-827f-a680426eaf92", "comment": "Malware payload (Mirai)", "value": "a3f4948acc7b81a1e2f2280a87544322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322332, "uuid": "db695279-395f-4198-8729-be9b0edc4706", "comment": "Malware payload (Mirai)", "value": "a6d3def5b155e533dc2ec826d19cac574437bd8785c3522afe159135b9c57d43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322332, "uuid": "5f6f723c-5020-4986-961e-c73d55a3d7b7", "comment": "Malware payload (Mirai)", "value": "b895b5d2403767286cdc90f35f850f41e7299c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322332, "uuid": "9430a9b3-5909-42f9-b330-382be8a5b9ee", "comment": "Malware payload (Mirai)", "value": "9351daa21675d0f0882464b11465330169817bdb92993d5affa8b0f5e63b057e2423a60611aedc04de31b6a3cc7e0264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322332, "uuid": "b852800c-acea-4ccd-b294-6a390c8e5e94", "value": "T12503F127E9DCDA84ECBE423504FD6AD50024A02F0958C3FD7AC8CE5E1A69FA77704699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322332, "uuid": "eef43a64-e274-451a-8d31-badb9a4e28f4", "value": "768:GAnRNLziAUCBA33o9oceVh2gaFo5y9ZQSx/ZR/iVBgrNIFnbcuyD7UHQRjl:Xn3LzCao3o9KEI5KZQKxR6Dg8nouy8HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322332, "uuid": "850beb6f-cf2a-4fab-950e-6d0fe3fb56da", "value": 39280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322332, "uuid": "d75eb7cd-b1e0-40f6-8ca9-93733dd9c487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322332, "uuid": "f2cd3b6d-ec12-4bbb-bef2-b4f5583f76d0", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f1e056-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780300371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300371, "uuid": "e0b61570-9019-49eb-899e-fab7ed7cd539", "comment": "Malware payload (ValleyRAT)", "value": "5ceee3fd368fc7eb8379de6b6f985c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300371, "uuid": "542e88f8-784d-45dd-b3e5-b08a36e1641c", "comment": "Malware payload (ValleyRAT)", "value": "a6ed39933c6dca6e3029934191f545b3b99a1a247dc96b7c97291b890577fe81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300371, "uuid": "8b4b633a-d4f8-4706-a2c5-69d2f6ef7640", "comment": "Malware payload (ValleyRAT)", "value": "70c10810df5853d5fc7624086b54d34a78ffe689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300371, "uuid": "d2870eb6-fffe-43f9-a74a-87b6803a1d07", "comment": "Malware payload (ValleyRAT)", "value": "cade4691a0ac16a46be3c7652c504db41c398089dca218cc9f377663d0170555f31a42a24c38a264c6eb5b06def67cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300371, "uuid": "aba027a7-0b9e-4189-aa9f-ac1782e85e96", "value": "T1D2F79E4AF751CD56D425533898EB475033B2E4A40B6BC3A3371E773D7EAB3A84EA0990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300371, "uuid": "55fc7977-fe77-4fa9-9f5a-0399ef455ed7", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300371, "uuid": "69f068b8-68cd-4b06-b170-42f94ddee456", "value": "786432:mftXNlNCxdpGIpPQXRUvoMo0h3248y4kkAWOQmrqykFq+a49G:wNORBvoMo0vGAmykJ9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300371, "uuid": "eaf8d101-20e4-4d61-86d2-89f25ff6f36c", "value": 74043136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300371, "uuid": "113bdaf8-ad10-41a8-9b14-574cc9e614ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300371, "uuid": "9749dbc4-a81f-48d4-93ae-61d8a9de4353", "value": "amh853563201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebd229-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780297636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297636, "uuid": "638b9552-398e-47f6-bd6d-1d413264713f", "comment": "Malware payload", "value": "5a70104215956eda639a83557dcfd7f4", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297636, "uuid": "6f89f928-9ca4-410a-adaf-6a9d2a62356d", "comment": "Malware payload", "value": "a728696cba3c76b8224bf5eb523ed6dcd5f9812d3d0ea030320cf97357be90d1", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297636, "uuid": "7bc517aa-c35d-4a12-bd40-750458d30e32", "comment": "Malware payload", "value": "b3dd392d6741b4656cd5173dd99a9234c78eaafe", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297636, "uuid": "b7f7d769-477f-487e-b3cb-d33a0dbb5bac", "comment": "Malware payload", "value": "0f66f5185fe46c47c5b42fd6b55321e3e9a030a76f72113f8db96f0ebd71b3037ec800308be2f9bc16a2f25b15ba4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297636, "uuid": "b90e8c9b-9412-4818-be79-6aac343b4120", "value": "T17E24F02098478234F92A59679F9C623794ED27F6803EB06A4DDE31C8CF1BA77D631D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297636, "uuid": "2ace6176-93a5-49f2-b618-64b20b653252", "value": "6144:IGz1bXlhwW3V2PslQeD9kbpdv1r4eP5pE1kuFueDGg/R6Q:IGzDhD3kz4W5pa65Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297636, "uuid": "10afcf17-063b-4700-a5d1-6cfbe7734c17", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297636, "uuid": "645ed40e-cfc0-4c5b-a3f2-a8c17597e373", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297636, "uuid": "ccd82998-fd50-467a-851f-80cf0c9359f8", "value": "Quote_36737_20260601.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e2a894-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322389, "uuid": "27beaf93-b6a2-4d85-90cf-35352cdb22f0", "comment": "Malware payload (Mirai)", "value": "3b2339b1580fcdf3dfa3fbb18fc0c5f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322389, "uuid": "5fdb4f25-5be6-444c-b312-ab817de1de02", "comment": "Malware payload (Mirai)", "value": "a75099665049f46919f43210dfea95098d8c038de65e1c707c160972b51f0b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322389, "uuid": "f49d3fe6-78b7-4c6e-977f-8d46bf7184b5", "comment": "Malware payload (Mirai)", "value": "d2f2cf0d7b0836736006264a433bd0f016953764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322389, "uuid": "a7c350f9-cbf3-43c9-8a9c-14171db5422d", "comment": "Malware payload (Mirai)", "value": "d3a98cb047aa4c9278aa4733c61c4da5f8ab36184ab27d1fe6d00ff305f165cb83c51855849d80e6ca982968731bc644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322389, "uuid": "2b9200da-b5d7-413e-8772-86799a494bb0", "value": "T1D093195AF9819B21D0C1127AFA1D158E331357B8E2EE72139E24AF3037CB52B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322389, "uuid": "704a351a-560a-4b88-8e1b-6e30d074c34a", "value": "1536:SpnXr4j+b51ErdJVMi/PFr0iFKta+5UIaeKfC4+qwp4ihB8n+Hf7TPFt50YijM:csjK5cdDP3K35UIae7B8n+Hf9tSJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322389, "uuid": "c4133100-0fd2-476a-8c0e-c5d7703fd979", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322389, "uuid": "4509720a-477b-44eb-bb60-3b2993d6ff0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322389, "uuid": "27a25bf8-3f29-4325-9f9f-2f27ca47e27b", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f903f2ad-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312432, "uuid": "56862565-77ac-48ea-a23b-5d839bb2f4c9", "comment": "Malware payload (Mirai)", "value": "3c062f0d45472baf1be8cc687abad1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312432, "uuid": "9ae9b19e-0a72-4725-81d3-9af663e479b9", "comment": "Malware payload (Mirai)", "value": "a7ba58e8fe34c25407cfd24297c45e0bb9c64ab33c372c81e460e8a8e35e88e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312432, "uuid": "2832c03a-7879-4260-a5cc-af597020c0d3", "comment": "Malware payload (Mirai)", "value": "5320b9454527e98784ce299ab0b17aa467de4a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312432, "uuid": "9b26fa0a-5f8f-4882-b816-7a9e258a0957", "comment": "Malware payload (Mirai)", "value": "2572b845d8ae5db3a4e38187a12edd5d9c42deaaa7652afc4d629bb5e5fe5e2876e5576bd22e9e11a38a154fb5777787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312432, "uuid": "85121561-485a-4cf5-81cf-363b907cb50a", "value": "T1E4933A02B31C0E57D1A309F02A3F2BE187BEA5D121F4F689691E9B859675E331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312432, "uuid": "1c46ded7-9146-4d0b-91d5-bc3125741d82", "value": "1536:xyFQz2A1C9HThfrOCY0lzG/lOvagdh2nnHT4U1CVKcXqjQYktapq+oqpOy+xIEHs:UM2AkT5YN/Tf4DEJCaXofBWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312432, "uuid": "6f6f34a0-326f-4ccf-ba6d-11ab7dcf4a22", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312432, "uuid": "4a5643b5-f447-4bd8-b150-274e0c1bceda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312432, "uuid": "98654746-960c-4cd4-bd3d-990ff5989576", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e56e31-5dbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780320531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320531, "uuid": "f342a0f6-9af3-4114-a24e-7e68db0b9486", "comment": "Malware payload", "value": "a6a7ada48f7c542a1b0a98fbf5f7aec7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320531, "uuid": "2629286f-2e82-4b82-8db5-52b5f9f74857", "comment": "Malware payload", "value": "a8eba9637e09573e59c257a534832b84934b9ecc930808ce020e0513678d7c4c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320531, "uuid": "42d82950-27d8-479f-9455-b9ef22d6639e", "comment": "Malware payload", "value": "f374c4f141bedf48333f56d1d91abce641e062c6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320531, "uuid": "97f70754-5953-4fcf-8319-561d960d3956", "comment": "Malware payload", "value": "ffbbeb703cf62c3a7e4499b1352f5472249d932b7eba7818812293eb07a72cb29799a4fa87b4aa12ddf5756f6c7c84df", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320531, "uuid": "cd56d13b-a0a9-498b-b12f-86c37ac7763e", "value": "T1BAF41997AE9001F6D25EE13485B7372AD736B83D27A28FCF92992D112F332D85939710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320531, "uuid": "84a9fd57-c2da-4c1f-bce9-9e4efe42f0e8", "value": "02f3da6463a067bed38f0ff3fb26c23a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320531, "uuid": "06623b34-4f32-478f-a8ec-6fbe731a8795", "value": "12288:bLQD7U1Yr9M6rTzp+DfjduHq5pghVlGByGJ9gSo22kI:bLW7UKr99vp+DfIHq5pgh/GBy312ZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780320531, "uuid": "5bfceb56-da97-44d4-b448-f1470b8e8d40", "value": 728976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780320531, "uuid": "e257f9d3-29e1-48b4-9e19-fd8b4aee728b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320531, "uuid": "a6b12efb-9802-4276-9abc-8fc07726f68b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e693a479-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "56a1f4b4-01fe-40c2-a87a-b71eb4d56259", "comment": "Malware payload (Mirai)", "value": "5e84fc29b9585d4578f0db872dc05daf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "b344c8b7-5a02-4302-8d2b-7f2b65d7183e", "comment": "Malware payload (Mirai)", "value": "aac7ddb06290ea067759714f70fa52c1a514e9a40576f50babca6e2c7dedcb83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "29c74c62-7e42-49c8-8675-c9ca93dc775a", "comment": "Malware payload (Mirai)", "value": "9ba47503cd70ab217c945bf7903628ba9722b344", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "66df7fac-25ed-4abf-b878-dda7fc0206a7", "comment": "Malware payload (Mirai)", "value": "bf558c8699cef6fcb45c393cf38284e9cc5f163132a25dbd8b8bf1933cef5ebc0a9e66ab9125becfb1ad514929877794", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "5e9713e1-01e2-491c-a772-0b607d9731cf", "value": "T14313E1B39233A8B0EC753D720A4547D1FDAE7C048653039B0E79F5AE8CBAA9E5D045D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "ad580ca2-fac1-4594-aa6b-6e56742c3c02", "value": "768:Pd6Rhju90wsPHrbfNfGbhdVDFMeBx3JtICQxTfBa5kqx05mmZx0rw8:PdSw3sPPovCcx5tICQxTxqO5mij8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312401, "uuid": "94d4498d-db69-47b8-9a74-faaaa8eeba59", "value": 44548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312401, "uuid": "e0109fc6-28d5-4f85-a792-57a135587dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "5d7c5482-08d5-45f4-b777-315bfecc1b7d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804dacca-5da7-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780310941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310941, "uuid": "36b779f3-0127-4dac-a81b-93cf7ef8c51b", "comment": "Malware payload (SilentNet)", "value": "53ff0ab57b89d32395d2579cb997bfbb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310941, "uuid": "a0216516-1ebe-4c60-9193-2174e73f3109", "comment": "Malware payload (SilentNet)", "value": "ab68b0caf004528d0df75bc614fba94dd82feab1f72ae34c6a0352cecd868f39", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310941, "uuid": "a2f13568-ae99-4d04-8e88-368345e4fca0", "comment": "Malware payload (SilentNet)", "value": "f5781180643a0607260bf8f662f037302c60b0ac", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310941, "uuid": "cf90c071-b3c4-49d5-9472-d06507d71dfd", "comment": "Malware payload (SilentNet)", "value": "a2778a90971ac6d42c7a7ca93539712e07ae0a664c3ceec7f5887f4658e1a8a92d5139fdeebaf4e222e626d13f2fcbb1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310941, "uuid": "43862e48-1138-487e-aeeb-b88cde0243be", "value": "T147642392D71E0810C5598FB583BD12E3DE7605708760181E0AA5F6A7AD84B8EF9FC5F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310941, "uuid": "0a09f938-dd82-4bc1-8485-e0d88b8da751", "value": "6144:jPcYiL0Ym26x71oBK6zvcRsH6aJfJJoRVnVo/vrRXqal3FX:jUVIQ050IO6wJ4kbRRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780310941, "uuid": "c82d65a3-7dba-4bae-a8e2-38bf9230410a", "value": 310644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780310941, "uuid": "00738be0-2f6f-4bd5-969c-9f97bf3bad17", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310941, "uuid": "d122d35d-f5ea-4ca1-8afd-048aa6d6f5df", "value": "crystal.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710ff893-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293736, "uuid": "f6d2c35e-bda5-4b6d-965e-71834c70c14e", "comment": "Malware payload (Mirai)", "value": "4c8cd96abacb5afa05f1751ad7882289", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293736, "uuid": "195e733d-53ba-497e-bc90-7d456eaa5e38", "comment": "Malware payload (Mirai)", "value": "acfed98d10718c85132e7f642021292db59b8aa62499f4fba889d6bc6f8cbbc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293736, "uuid": "23235db2-74d3-4cc3-b0b2-5b93fada5fab", "comment": "Malware payload (Mirai)", "value": "9945bc5f4af6fceb06b336abf2114415dd629fc2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293736, "uuid": "83127db6-a7f8-4dc2-bebb-3f139c30f0fb", "comment": "Malware payload (Mirai)", "value": "d464ac56c5027bb5f53c1ecdb5adab629cef33586995a4157b0862b9d3ede7435939fd39b99b9d355f4628baacc1037f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293736, "uuid": "445f7fb2-20ae-42b3-a4ab-9ad57c1bac11", "value": "T1FCC3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293736, "uuid": "a7734f9e-e876-460e-938a-e72fc2d248b5", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMoN:MwCvdHmezn0nUPMu9KryXsMoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293736, "uuid": "812df164-0966-4d74-81c3-a7fff4381358", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293736, "uuid": "e8316bae-5c21-4628-b23a-afc67d71627c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293736, "uuid": "f9b1c9a0-7b66-411e-aa07-0892d20563ff", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf0eace-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780298505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "8f7b3155-62f2-4f76-89f3-42f2ad6fa445", "comment": "Malware payload (ConnectWise)", "value": "d357a0da5c0c55f366c52d2400424a9d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "cc54af4f-7283-4868-8c25-b1dda6ff4e3e", "comment": "Malware payload (ConnectWise)", "value": "adb11eab5a309ae2e9527ad93aad006f1a2343ab7bf8db6e6f25b0c0b256910d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "281068ea-57e7-4f6f-b595-e76f72407807", "comment": "Malware payload (ConnectWise)", "value": "cf00749483e65f714c50cb0f118b580526b95d01", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "4ea37d18-132c-486c-9b75-175980fa32cb", "comment": "Malware payload (ConnectWise)", "value": "ceb3469e87489598663c8d5db1cb5e52b91d6d285d185ed425d263cd450801db6d700ef7cc3ca529a3f1e6f127a15657", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "40fcdafb-a4e7-4434-b50f-6b4f36dc99b4", "value": "T1E046E101B3D695B6D1BF0638D87A56696734BC048316CBBF5794BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "70b41f1f-e826-47f6-835e-52ed7fb81ef9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "ca3d5cb4-509c-4a58-841d-ffd6a0e23216", "value": "98304:bzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:bhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298505, "uuid": "34ed0ad9-bf94-4781-90cd-e950ec7b7485", "value": 5652104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298505, "uuid": "3c903056-968f-4235-a8ed-3fc46e196c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "664f33f5-e44f-4119-af36-2ed55c25b0cb", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57072ac-5d9f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780307702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307702, "uuid": "db19f733-83c7-4197-8cd3-a824bcb9a3f4", "comment": "Malware payload (ConnectWise)", "value": "0681bb7f2505eede4e9d83dbcc149afa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307702, "uuid": "a0f50b66-0774-48ae-97d6-ae5ee19e8625", "comment": "Malware payload (ConnectWise)", "value": "ae20fbf51866a5b30ade870b2de1e32d0bf1a2027a28700fc3bffbd5ffb922f7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307702, "uuid": "4c66a60e-ac31-4620-9963-ed059aeb6060", "comment": "Malware payload (ConnectWise)", "value": "7e11f1cc127ace982de8ad60bc65317d2111c2c3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307702, "uuid": "0c0de0f8-dfc4-4874-8e2d-c83953fb9c17", "comment": "Malware payload (ConnectWise)", "value": "5b719f16661e48c9c67f0387e3a8e6556bd0e36f45bb874c166afd5b785722714c21cc1973ea26d9a304ce58d9e679ef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307702, "uuid": "55af7b2d-5eb2-4b53-b050-ae311927f1af", "value": "T13DA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307702, "uuid": "e3fec94e-c9ad-4029-a8f4-df8f5e11291f", "value": "196608:gnCtVYqI5MvbWEpKkqyIJqK4nCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkq+nCtO:UCXvI5MvHxWJWCXvI5MvHx6CXvI5MvH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780307702, "uuid": "4523f3f3-3b2d-4abc-8e15-19464b95e225", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780307702, "uuid": "8dd5331d-813e-4ff1-9edf-a10615f14857", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307702, "uuid": "ba742a81-b7a9-467d-b727-ab4bb0a7689e", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416d4ef5-5d9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780305252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305252, "uuid": "bc4c6719-6c0e-42e0-9933-493373c73e38", "comment": "Malware payload", "value": "9dfbb8be172982fe03c7f8d33fc5ea37", "object_relation": "md5", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305252, "uuid": "5f4a9358-b6f8-4a00-8a9b-c732f25a4d06", "comment": "Malware payload", "value": "aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42", "object_relation": "sha256", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305252, "uuid": "548f2fd5-a579-4fc1-b398-637634c220c8", "comment": "Malware payload", "value": "ddf60c04444828c7bae17ee6f84cf86db7291e9e", "object_relation": "sha1", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780305252, "uuid": "a0f233c6-5ae5-41c2-b089-3830e90676f9", "comment": "Malware payload", "value": "24b4385e9f265b2e7a4caac4935ce6a5ec35a7dfc3fd09b1964c881093210601edeeda45265e4ec67fc3491852e38066", "object_relation": "sha3-384", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305252, "uuid": "94ac1a93-0856-4e56-8a90-2d5ea48ed995", "value": "T15EC2844919E34952A3B7F0761BDED4187A5BC1974B0DDE207DAC42DABF90039D2F8AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305252, "uuid": "e1b32503-3095-4bab-8896-386ae1a43785", "value": "384:QssSHe4XDp2fv6Mf8JSN6WWabfd43+yZzB3l5:QssGe4XDp2fv5f8J7WWARy1B3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780305252, "uuid": "948790ab-61f4-42a4-8e05-6ddcb9522dd0", "value": 27994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780305252, "uuid": "b5844729-ac73-4326-a5c9-a1b3862041ca", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780305252, "uuid": "016f40fa-64ed-47e6-b378-2ff89dcd8005", "value": "zed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ed2fbe-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780298368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298368, "uuid": "58237b58-8cf2-4084-a70c-23571868b19d", "comment": "Malware payload (Mirai)", "value": "a0f9269e1059816179e6c8be86aed807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298368, "uuid": "c8d17c1d-2336-45c2-aaa1-20a9322b62b5", "comment": "Malware payload (Mirai)", "value": "aed6bef34a62f53b32fdbcf85a47638543751cad751cfef2140af34ade90444d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298368, "uuid": "2937c9e6-b99a-4002-9db1-93d252481634", "comment": "Malware payload (Mirai)", "value": "48fd17702c583c66d4e01a4888cb7f3cbf9e85a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298368, "uuid": "ea454061-94bd-4c11-a2b8-96be83a782fb", "comment": "Malware payload (Mirai)", "value": "382f9196e253ecc0c024b853360fbaf9032a826329368f7a025fe0191dd1478b27ce8468ff75c43ebd440baf5cf79cc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298368, "uuid": "f780a9a8-c56e-4d35-81b9-aafdcbd151ae", "value": "T16F932895BC928A16C6C513BBFA0E42CD772663D8E3DE3117CD259F2133CA96B0E67141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298368, "uuid": "8a7d5c2e-d9fa-429c-8869-7a8c974e5066", "value": "1536:H9gBqHTn2IpA9pFHtBcis85XfIgmhya5bvFG5PXwxm:dgiTVpCNBciTP8bv8Pym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298368, "uuid": "da14af66-eab1-4fc7-883c-abf247b2560b", "value": 89284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298368, "uuid": "a9e06b7a-7afb-4353-bad9-af3d3708bdb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298368, "uuid": "7213d058-b76a-414e-b88b-acacd5f05ed4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26772f48-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322387, "uuid": "0a0bc339-38e8-48eb-a468-aac4f0ec6858", "comment": "Malware payload (Mirai)", "value": "377f3096bd020037073555243ad980e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322387, "uuid": "6b58d0b1-c4da-43f8-91ff-e1a2c1ac8df7", "comment": "Malware payload (Mirai)", "value": "b1e41fa3d64a2287513da472a2d68d186b71c4cfc26a083220a4d7e9619c2d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322387, "uuid": "93959d0a-c3fa-43b2-a851-177602e54a89", "comment": "Malware payload (Mirai)", "value": "f693ffd85cf656ca9e76c28555685e838f7fd5d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322387, "uuid": "b692323b-1fc7-476e-888b-1d9f6b017a9b", "comment": "Malware payload (Mirai)", "value": "cd6204aafcd12007dced4eed131b242105dcf1d61447b017c3be230a731c9ee1a39a7c8e679caabfe90b491dea084f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322387, "uuid": "0c7e6ae7-0049-487f-b785-267890e1a673", "value": "T1B4B3B50D7E219F7DFAE8C23447B74E20A65927D627E2C685D2ACD6011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322387, "uuid": "ca178979-4196-4c66-9f30-8b51ba026d65", "value": "3072:6uhTc/oMcjriXBsELWCHcFBZ0Md646NfmOfurZao5ZIU:6uh8cjriXBXHEBZ0Md64YerdrZIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322387, "uuid": "6efe4091-5c8f-4ee0-9a20-70cb175b5787", "value": 113676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322387, "uuid": "f3e66186-d043-40ae-99b2-e744abc8beba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322387, "uuid": "26e19f9b-bc1f-4ff7-aa0c-923fa703c07f", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a2147d-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293022, "uuid": "9e2f8416-a63d-4b77-b589-259def689e06", "comment": "Malware payload (Mirai)", "value": "7fc36e1fcae0e37a7156ecdde654ed29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293022, "uuid": "ebaac127-d647-4f35-b270-a914b7815e51", "comment": "Malware payload (Mirai)", "value": "b27dce6097308006223f5ba6b3a77a75f8ae5ba86ee6e45a5d0a297a62835a2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293022, "uuid": "3943e9a3-b422-42fe-ae5f-d6a9b8f64202", "comment": "Malware payload (Mirai)", "value": "3810bf50d26ea6a4cb4bccf2280ddc3ace77ed3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293022, "uuid": "0d2834b9-eb66-4bbb-9758-e0321c32f22c", "comment": "Malware payload (Mirai)", "value": "e0dafa5e336c439b72c8ca71149b2a695714eefe8b2f7d0591c801f283c5ed9b4a1daee28d432b13832a88eaa34f3434", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293022, "uuid": "5e41ff4b-d376-435f-9d91-b11cf3eaade3", "value": "T19DE33A07B5C084FDC4D9C2748FABA53BD972F55D1238B16B2BD4AB261E4DE305E2EA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293022, "uuid": "295386b5-5522-4611-a6d3-2370d42d5286", "value": "3072:NF8OlVIc5JtVZ/MDlpfq5TFbNQrwN088OC5W6jsu6G:NFtlVl5PVR5JpFNv8WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293022, "uuid": "f3a5594f-87bd-4ba6-8a74-d9579a81fc95", "value": 153480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293022, "uuid": "a61f955a-1c13-4367-8183-276d6f7c334f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293022, "uuid": "39e91cf5-bb1b-47e4-9c1b-e1d501b103e9", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ff8f30-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297613, "uuid": "e5668c5b-bd55-484e-8747-3a492d9ae0ef", "comment": "Malware payload (ConnectWise)", "value": "ed415ae569cfe773fe67af3fafc709ad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297613, "uuid": "0cfef7e4-fe47-49f7-a629-a698813e4a0a", "comment": "Malware payload (ConnectWise)", "value": "b289af869fb9678b90e1aea12a460bcb58bb0751d2c421d5fefb3acc5a69944c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297613, "uuid": "f71ae359-e592-4899-b490-81638443a551", "comment": "Malware payload (ConnectWise)", "value": "0ced6ffaf0bf51727d06b11a1aa3305872d9c0ae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297613, "uuid": "f0b04d41-6ac3-4c2b-b1d4-2cd355538563", "comment": "Malware payload (ConnectWise)", "value": "b9628416e97fb9c437457d5cf4a4e2671a99f1c7e90b48dd8f73a843ff849940658694a2152b959ed8369142e9844d40", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297613, "uuid": "a478bbe6-b1a2-4a2b-a53b-525ee9dc9a8d", "value": "T1DA647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297613, "uuid": "0cd2b6aa-a944-4fd4-890f-bf641c8395ec", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297613, "uuid": "f69ac1c7-23e4-4fc7-babd-ca241be13f5d", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297613, "uuid": "ecdb9716-ce5f-4da8-9407-084acc981a42", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297613, "uuid": "f703ed2c-6d88-401b-afe3-eafb9a22b9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297613, "uuid": "ec151510-ce92-4c43-b760-f2b311e704c5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ef2448-5dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780321599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321599, "uuid": "ece66471-3b75-4507-9170-bdc2dd2fdc02", "comment": "Malware payload (Formbook)", "value": "5cb39924344584449cf59ef837d13030", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321599, "uuid": "151da6b9-3afe-4153-bf3b-9528317a72e9", "comment": "Malware payload (Formbook)", "value": "b48d2c1828e295d86ee3df3f031559447b00351ee17491e6d798116f5b7190f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321599, "uuid": "cc9523c7-3acf-49af-8092-1f6c2354b29a", "comment": "Malware payload (Formbook)", "value": "81edff4ee8ceef0208f12fd6444654d3d26124ab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321599, "uuid": "9a4d4c17-baa9-49fc-9558-04ff3f0ff803", "comment": "Malware payload (Formbook)", "value": "23ba8a88d28666d35bd78e9cdb1e248c3ee9060319dbaa42e9042bb8d495121ca043ea5dbf421eac063ba423aaf82421", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321599, "uuid": "816bf389-149e-4aab-b792-4002b45bf7ce", "value": "T1C8C2B53AC984AEF40B2B21D2298F3E175505071376743A4DB9CED59D2B7A350CBF0AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321599, "uuid": "e6ea2542-a6f3-41c7-b60f-cf0ce522cd02", "value": "384:Khxb1bc8u6ZLhoo+ZcWTEGNzhXTMDtA4gSzmn/jMs1QA7NzgvKKaLN25mLBX820g:K26ZVoo+iWT1xRAhABBd3QIN2z20a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780321599, "uuid": "775f4731-3f32-4a48-9e34-9a203a117b4c", "value": 27894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780321599, "uuid": "88825aef-6d04-47f8-aeca-7166575fec7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321599, "uuid": "4a1559e0-c532-43e7-8865-109e3bacf7f5", "value": "PAy_SwiftMessage-$200,000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17352bff-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300028, "uuid": "e58dfc48-7c54-472b-8dd7-c7e1aab7a358", "comment": "Malware payload (ConnectWise)", "value": "f7dbe4786aeccc184460f1a2d2015514", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300028, "uuid": "11860fe2-673c-4bfb-b209-4e987a085a88", "comment": "Malware payload (ConnectWise)", "value": "b565ed7f9eaf57ae423c3891083ede7457339d69858b31f3c04c2fa5c7d2a1f3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300028, "uuid": "f181fee0-b4b8-43cf-9d2c-9a3b64084904", "comment": "Malware payload (ConnectWise)", "value": "c62bafabc58e234afcb2ed91cadb72c1ac51e79c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300028, "uuid": "b5bd736f-91e1-4086-b89a-75419f2f71e5", "comment": "Malware payload (ConnectWise)", "value": "60becbddb3949f3fa5bbd72174009cd5a5146dcb4090d3b13c4c5c1af33b10f7679b5f7f22f39d9f45f6fce1277e5058", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300028, "uuid": "a7c80c33-32ce-4f23-8dd2-42bedc9f6fd5", "value": "T11E46E101B3D695B6D1BF0638D87A52696774BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300028, "uuid": "32358b1f-359b-416a-bc4c-eb98c43a0d76", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300028, "uuid": "5309d001-f36a-49bb-ac8e-10c650dab344", "value": "98304:TzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ThfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300028, "uuid": "ff20d6ff-1e8d-46c9-98c3-c76b04b437bb", "value": 5664384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300028, "uuid": "f5980eb6-f0b6-46d4-8cf9-760952ca43b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300028, "uuid": "9d32a4e6-14fa-4ac2-83c1-d422144e67e9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a96dda2-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274263, "uuid": "6ba5669e-0dbc-446a-80b7-3298590bfe9a", "comment": "Malware payload (Mirai)", "value": "1e0499b82e6f90d369a97474e7746c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274263, "uuid": "eae544a2-e9cd-44dd-9703-5fbc62a1da4f", "comment": "Malware payload (Mirai)", "value": "b60a78fe39a2a8e31e1a3048f5853fc6e41281e1a146d0978664497b4507b4d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274263, "uuid": "ce5d216b-47b6-400f-9f7f-59937a6f00f5", "comment": "Malware payload (Mirai)", "value": "560cd42c83d59a4a8387b8a91d2581ff350a551b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274263, "uuid": "d309ca54-16a3-4b8a-86a0-a8c190b14ec6", "comment": "Malware payload (Mirai)", "value": "4948672b160ecd3a2eb2a2e8f3fac5790fbe328c7d06982f7e8f0dbc43dfc50927d1e864cd1f5782487da48daba3cb2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274263, "uuid": "721625c8-dbe0-4f16-ad56-bbc16ec949c5", "value": "T12AF2E1245E15019EFB9698BB2CCE03D10D6D0FB39396DCB43A42E5A36FA813D74972C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274263, "uuid": "2f2a47c1-41e4-4dd9-91e1-04819d4e60a2", "value": "768:alWqYyhCJiLHYFiOw3Bly1luwW5SQ10vcoPRSXhvJgGlzDpbuR1JQK:Rq+JwYFnw3/Rwq6EJX7VJueK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274263, "uuid": "13a5bfe0-4bd5-4111-a0f4-beb608fde519", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274263, "uuid": "a3027600-3653-48e3-b716-b4821d496a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274263, "uuid": "abbe019e-1a5b-448b-ae65-2ae4edfab3e0", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a10b4bf-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292409, "uuid": "01153479-9cc5-4acb-bab0-34fa3dcecc11", "comment": "Malware payload (Mirai)", "value": "9915d27932f3d2e04168156763de5c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292409, "uuid": "68f88a70-7c5e-4d30-a839-4301aa5f0d16", "comment": "Malware payload (Mirai)", "value": "b7dd9bbdb76c74b14a552ae6dbf08aed4159d896c21009a36331e5d60b6cf184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292409, "uuid": "37dba95f-5324-427f-81f4-8e46a6cc2de4", "comment": "Malware payload (Mirai)", "value": "6c4b760c06e8abc6c9e1860eff8b1275517d7b53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292409, "uuid": "25402c3f-5753-40cb-98dc-0c17024e8639", "comment": "Malware payload (Mirai)", "value": "169d37b0ca8507b90a68eb69e51cfc9fca0e202471edc52a54e8e960403da7b837bc5552556242fd06863503829f527f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292409, "uuid": "77db14bb-9c99-4756-a155-3aa2486d5851", "value": "T10DB31956FC818F22C5D602BAFA2D118E331227B9E3DE72129E205F2437C655B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292409, "uuid": "66a3e251-2afd-403a-b707-8b520c91a5e1", "value": "1536:P4n44PUJaNvHLhO8z96EXQKM7+MLWhW8bkf41Q6aUjXKzcgI8iP7yS7gHmZS51YB:ouad1Om95QHqiWV+6ae7yS7gHmZS3xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292409, "uuid": "d3c47a1b-fc86-4b70-9b1e-ea570713025e", "value": 113100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292409, "uuid": "aac625ff-87ab-478f-90e4-45a831a426bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292409, "uuid": "a12dd851-dc3e-4cae-b8ab-34dc81f10528", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a49e2e-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292182, "uuid": "1de0c75a-e4db-44e6-bd78-85dd093fca97", "comment": "Malware payload (Mirai)", "value": "4049d38de6fee3e86b0f7f5f3251648c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292182, "uuid": "4e439b72-0538-4681-8cbc-998c369eca10", "comment": "Malware payload (Mirai)", "value": "b84325f033c20817bf7aef7c2a0a1f100fa2c52496571f053a3a15c9a19d0195", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292182, "uuid": "24054150-3ab1-4bf9-adf7-451c79a2f060", "comment": "Malware payload (Mirai)", "value": "cc04330c7ec5454bef7af0d5152519027c9b97f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292182, "uuid": "2042533f-b533-4e87-a2e2-6be983d38d4f", "comment": "Malware payload (Mirai)", "value": "d27d75001ddbb1c03f366d4d3245eb1f8c6707a994ecc624a2d608983d1d103ff20949f4a677a955ebaca5a2e8a8dc3b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292182, "uuid": "6408b046-67ca-4aaa-b418-f0d1672d78ce", "value": "T1C5933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292182, "uuid": "6c8ca0b6-4026-421c-9e56-8fd8fa98e283", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LhR:KvjLrKGG4syfcIhXiuxpUN48Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292182, "uuid": "3d7b03f0-9561-4bba-bff2-2a95afb3f82c", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292182, "uuid": "3806212d-047a-44ba-8730-bd648cc128fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292182, "uuid": "5533a868-bec9-4065-80b4-7363eb42b313", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d5f8fc-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "3c89d6e7-38fe-4925-85a0-519cdcb7a720", "comment": "Malware payload (Mirai)", "value": "7bc098b4445e7e1a69962f16351af2d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "291ca199-bd5d-4975-98b8-0ab4a20b0e94", "comment": "Malware payload (Mirai)", "value": "b98c7f756334d7dab2b416803ea76c317537701cc8113bdbc74fbac3bae2c29a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "676247eb-c4dc-490e-915a-96f9b4895df7", "comment": "Malware payload (Mirai)", "value": "d7316df726d2c137fea786bdc2626b976ba6ef71", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293720, "uuid": "d8b4e445-8f21-4227-a920-8e34517d6d17", "comment": "Malware payload (Mirai)", "value": "2ed2c60f541e0a185fbb9a0da72d5fd3db22d43342cd9e91790ce7b099b1395975b65571869f0b9a28a092a375c3e6fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "6297ebd3-175e-456f-892b-692eed02da6d", "value": "T19C257B2EF2B2F1BCE007C03417DFCAA15525B07926312DBB37C49A353E6ADA15359B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "68868fe6-8114-40cb-80ec-5b3f7f0cf099", "value": "12288:Jia3oAbeNgvzRNwGdoHtMLi+CSegujoS89uUbHlTI3kayQgLonHX:Jia3oceNgv/Bly8kUbHl0iLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293720, "uuid": "af437758-4643-405a-90a8-6df9186c3478", "value": 981512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293720, "uuid": "5a016311-62d9-43fc-bb69-c0ca57c6c0c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293720, "uuid": "875236cf-f1c0-44a6-b11a-51ec87666eca", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952d3bac-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780293797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293797, "uuid": "dd00e4e1-e195-460c-a3c2-01dc4db3e169", "comment": "Malware payload (RemcosRAT)", "value": "39ee91f412ffd1e5fbad78f72c73933c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293797, "uuid": "17ded9ef-562e-4e69-88e7-9a3d5af13558", "comment": "Malware payload (RemcosRAT)", "value": "baa8f1b88835077909bb98bed0a5c61a765cdbd82dba44f0a5fffb9e64b1e868", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293797, "uuid": "fd8cacdd-20ae-4ea0-ba87-a5eca213110a", "comment": "Malware payload (RemcosRAT)", "value": "13197b28078262d1a86a866d2e75566b10c2fb25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293797, "uuid": "c4b4cb17-7fb6-41b1-8796-9f9327da87b7", "comment": "Malware payload (RemcosRAT)", "value": "65282e5b62e5658aaca71869f37322a588598eb69e876a35be3ee35cb9d9b514222056a8760611672c24e341c8b9fc39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293797, "uuid": "ab5f6953-a417-4e77-9ccd-e381c62abda6", "value": "T18D365C17D66F974E18093B61006A5D9AFE89CAFCEF727BC4E0CF90B610EA1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293797, "uuid": "f714b6de-192b-4d35-b21a-b6286bcb6bce", "value": "49152:L5hwahOts1gkSLPztK8bcJdYp/QsxYHEweXUFMLO0gg7XtPxRqoj3GQVjMXfLQbs:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293797, "uuid": "d99d7401-d9d9-473b-92c1-f828d831b7d4", "value": 5023730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293797, "uuid": "66e0b12b-8fca-41e2-b320-f07abc52a6d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293797, "uuid": "f8244255-2f8a-4110-b0a2-c9403e1e58c4", "value": "quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb8a12e-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "69e82db9-40f3-4306-9b3b-a236af3e2144", "comment": "Malware payload (Mirai)", "value": "6e72f299d3b21916fcdf3091c73087c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "4cd0296c-88af-48c2-8022-e64c555df3ad", "comment": "Malware payload (Mirai)", "value": "bc1074fe352095821109955f01726026830aa9a418d5ea699508fe0eb44537eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "09adf48a-6c13-44fd-b6f4-3755acd8c26f", "comment": "Malware payload (Mirai)", "value": "4fc542493d8d6ea7b073d267eefd7c6178191c1a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "fba10df9-15dc-45f6-9ef0-52c641a56da3", "comment": "Malware payload (Mirai)", "value": "3a401ffc9eb4dbe22d4238601b66f7707fc62de27721102ae1b395d09c41bcf70e7ac6e16861a6988518321872b20257", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "1db2ff56-01ce-453f-ab3c-a201cf53313e", "value": "T132932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "396a0d33-8023-40aa-9d30-2b7a9dc6e525", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2e:AGUJtkyYEETn0T32TDBf0nsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292177, "uuid": "1f40280f-f498-40e0-bfea-9942ef6ecb4a", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292177, "uuid": "19a121cf-efab-4143-bc64-f68f0b38be14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "21a8132a-0821-417c-a60c-1b014b672bd8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6f4614-5dbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780320684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320684, "uuid": "151ad075-8f85-45b4-a05b-490cbf2607c3", "comment": "Malware payload", "value": "04628328ac01e764d7c2adac95fc754a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320684, "uuid": "2f6b21c9-8656-47ae-aa7c-bb66b6f7f579", "comment": "Malware payload", "value": "bc2eb89c31d2970a3c3f9657c6e5c4701082d374a88b2c06b4ffbec0b8dca63b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320684, "uuid": "0feb9c82-f7d2-48ab-bb28-8cde0a362c21", "comment": "Malware payload", "value": "a810f5e393b714af5f9c0ab0e1aa92a62c80e4d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780320684, "uuid": "ea02ab24-96cd-49f6-935b-f23f386c0577", "comment": "Malware payload", "value": "eccca5e44577dcdf5efd11fa44f1ac136838d6939394e4fbcc940cf4c3a91a0572f6e853a1a856a1a2d0e002b77b6138", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320684, "uuid": "8527052b-1dcf-4693-96dc-2701b631c642", "value": "T1C0259F02B1D2C0F2C5151A7115B6633A9AB58B0A4B3DCAC7E7E4FD7D7C32292EB32159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320684, "uuid": "3dd106f9-bf9e-40ec-be37-251e1be6b33f", "value": "18fd7d37c86cbc5180c571d947a9e623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320684, "uuid": "a7d75053-c018-4678-9c12-477c706a7df6", "value": "12288:ii9CUy39ifguyr6QLyEH3W1BS4SG+Kne/EAm5mY9v/Zho6WoWcPqu8:ii93y3e/yr6Sys3+5SvKnNZzWcPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780320684, "uuid": "d8fcbc3d-2134-4ede-b90d-69002a0ebc21", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780320684, "uuid": "b8550e91-032e-4b18-bc07-58ae929b472c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780320684, "uuid": "aa091cb3-49fc-4be3-8eec-31881387044b", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa6ddd0-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780294155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294155, "uuid": "e95dd010-5379-4d29-8f9d-c3f6ada5117c", "comment": "Malware payload (AgentTesla)", "value": "fe09206aa3211320ee73002393c2b964", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294155, "uuid": "74e74f8b-6868-4ae9-9ff5-a6f5fd88b513", "comment": "Malware payload (AgentTesla)", "value": "bc73fe11955ff97c6eb8b3e5a85d02c5fd728103c046f85150b8e8d13c16c939", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294155, "uuid": "b76bf1aa-6efc-4c38-8074-ab9a6c439984", "comment": "Malware payload (AgentTesla)", "value": "998e09fc6b457cab943afe8ed57306445fbb6a73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780294155, "uuid": "43f5c7c1-884f-46f5-af03-44d49c285ab6", "comment": "Malware payload (AgentTesla)", "value": "d18cdcd068b5aa66225c600c307d6bc5f5977727e7e78301569248243d07ab47998695c95107195f8a032bda05d88647", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294155, "uuid": "3145c314-b91a-4f3d-8fa0-a91e5d0f7c0c", "value": "T13346E8536997911B730A879E8972F9E1E80E2D27B4035507706CDC28B3EFD9762AD233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294155, "uuid": "2f40b38c-d8d8-47dc-b630-ac4c03277086", "value": "98304:So/8rkdYsE4c8k+1K7ande7p0oG4k6A0n9UxtC6v1xzp4Wn3m92dCe0uNmjnGHxU:So/8rkdYsE4c8k+1K7ande7p0t4k6A07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780294155, "uuid": "6f71beec-4894-4003-b692-12bb1b095d02", "value": 5843105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780294155, "uuid": "bd3c6ad9-2c68-4d8e-8e75-eacaa48b301e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780294155, "uuid": "a85f847d-ae12-44ff-8e4a-9fa5be4ab979", "value": "PB20251131-PO1.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbd6a04-5daf-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1780314425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314425, "uuid": "a93db92c-dd4c-441a-a98f-3d1535685c2e", "comment": "Malware payload (Cobalt Strike)", "value": "5f081d9573ea9630bdc8ceda2ed24ce6", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314425, "uuid": "f1ad4b89-4d7e-4f87-9994-7ff4fa7cd6f5", "comment": "Malware payload (Cobalt Strike)", "value": "be6af2c0f0378fd946407b73a19ea0010df90438cc1d6e6cc883ede508e90d9a", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314425, "uuid": "51e5eae2-ad75-4458-9c2a-7a9b2c8ea3e7", "comment": "Malware payload (Cobalt Strike)", "value": "673fbdad3cc9c23919499f03381c050bc1425e11", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780314425, "uuid": "0c6f04c6-1739-4fd3-b231-a8f93f8d5299", "comment": "Malware payload (Cobalt Strike)", "value": "c4623eea5dac0ebfd1e64ae6c89d9e88e9b3619258d75a1cc1e2ae3793a5dcff8de9805e0b4f63a38bd5ea9ad6a39823", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314425, "uuid": "af5f58a7-988c-496f-824c-c4af205bc916", "value": "T163F49C30264963B1E81924B6393F7E984D9D1D6CEB5AE2137EB3377A8E774D09CA3001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314425, "uuid": "c28ecffd-06f6-4877-b995-4831d3e0d558", "value": "451396bd58f62cd35f8993dd66ab5442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314425, "uuid": "c0e1ee5c-64fd-4bab-b297-88644ecdd410", "value": "12288:iV7Hw2p8rzoApsf1qCi/btAgcP3HuDfvN4Z/QsKAApq/:EywCWqrh/cP3HuDayzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780314425, "uuid": "5eb12858-17a8-4022-a756-9cb82b3e35d5", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780314425, "uuid": "d89c7d33-e67c-4747-8619-17afb5716414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780314425, "uuid": "ce39517a-cacb-4d12-9b5d-2f0d45148aca", "value": "\u4e2a\u4eba\u7b80\u5386-\u4e0a\u6d77\u8d22\u7ecf\u5927\u5b66\u6797\u96e8\u6850-\u98ce\u63a7\u91cf\u5316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7d8df3-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278161, "uuid": "1bcda607-67cb-4470-b7f1-28a000d12dfa", "comment": "Malware payload (Mirai)", "value": "e0ce3e0e43030ce4bd3f09f2c8bef062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278161, "uuid": "b1c019be-6e4a-4063-9586-85245f6e1b04", "comment": "Malware payload (Mirai)", "value": "beac46d485b71c012ce230d71ab511375f0680e158b3e19098ffed39583afeb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278161, "uuid": "ac3008b8-cde5-40f0-92e6-e03a072e3e8b", "comment": "Malware payload (Mirai)", "value": "a7ec9e612e8944f658abca0ae2d4b8d1d9ade59b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278161, "uuid": "6631b221-a9d4-402d-b01c-8d8706e87ddc", "comment": "Malware payload (Mirai)", "value": "ca6e1e0a20555aa70732c0063e48e3cb9f033b345bbef1d06dfa67685e1f3ddc8901865f42819581813ed10e3faaead8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278161, "uuid": "d17a010b-dcee-4154-8341-df15c800b4ec", "value": "T13653AEA6CD2E2E98D8040578B825CF7D9B23DD58C9531DE18A768636D007DADF89C3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278161, "uuid": "1d4806b1-b532-4c1a-aaa8-956ada7df8d0", "value": "768:VUcvrVYPytXW+F7W+F2+FW+FnXZJ86Uh3DgVneqacoawrV/eYtmDHPYn6cGy8oCp:VDvruuthhqhzgWfVtmDHA577CDJMCds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278161, "uuid": "bf382a3a-04d7-48e9-99fe-28c9e717fcb9", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278161, "uuid": "b255f446-23ba-4639-a865-8111e9cdabac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278161, "uuid": "431d2f8e-ceef-4040-ae85-e417fd21b490", "value": "beac46d485b71c012ce230d71ab511375f0680e158b3e19098ffed39583afeb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e526d2cf-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1780346759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346759, "uuid": "f414e8fc-00d1-4a54-a33d-4847e9c8ebd3", "comment": "Malware payload (LeetHozer)", "value": "e8c0c923383f068f11d00c4dc552ea1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346759, "uuid": "bd5ab7ff-c446-4ff9-8844-ff4a99dd8896", "comment": "Malware payload (LeetHozer)", "value": "bf195a33cbaae31325bbbd07fb4c5ed88123e87d2d09c151bb7e695df410658d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346759, "uuid": "6c5a172b-bde6-44e0-af9d-dba3cdecfea6", "comment": "Malware payload (LeetHozer)", "value": "4cd3b29ebaa8bb61af9409ecf33d874e7d47dcde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346759, "uuid": "3db8694d-8975-4880-87b7-fd7eb17d2ca8", "comment": "Malware payload (LeetHozer)", "value": "46ff40b54573718c94414e057f1e2eba193b07b56172e14f810516bd70adcb6173b78cf737daff5c2dcc90e45e737b33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346759, "uuid": "53656a32-d33a-4936-af5e-2cb61b2f6fb2", "value": "T11F13F135D147B8B2C07149F12D7E4B233E9795B8B7BA711631883B8DD29274AF2EE190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346759, "uuid": "96977ce2-627e-455d-ae1f-2f3f8e58e5ec", "value": "768:BcbYm5cr+lKBCpLOdqeFUPmAN2G3rZ/LZ/vHo+WgGO2xNvY0Tu2T0s3Uozw:sb5u+lKBCpLaRgV/l/vHpWglyY0Tu2ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346759, "uuid": "766a29f3-a917-4425-885d-9b737d36634b", "value": 41724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346759, "uuid": "801b5e9f-77f6-4b95-bb63-8a09a6baedd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346759, "uuid": "e9d54cac-51d6-442a-a6ed-4397931158cd", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187dca63-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300030, "uuid": "f22785f6-3175-4bde-945e-18357502da0e", "comment": "Malware payload (ConnectWise)", "value": "ec5f44929f1b041015ade61fb4bfbb05", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300030, "uuid": "8b639b70-fd24-4b8c-820a-b3232b20d41d", "comment": "Malware payload (ConnectWise)", "value": "bf497f9612c16088eceab8f92d68f5e95afbb056351acfc90b0e697a36e26d76", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300030, "uuid": "169cc48e-977b-4157-a087-05b6315e1421", "comment": "Malware payload (ConnectWise)", "value": "392451e8358d4ae71a10b855c3410d887a0360a8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300030, "uuid": "f18ee432-d37e-4a0a-be04-4227da904880", "comment": "Malware payload (ConnectWise)", "value": "b8018eddc3b3bf87873061c19fa8ac0807253554670ebaf12da659e3b153dc6a6ad5587fd33036e82fa0a36acca54876", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300030, "uuid": "596c382e-3ec9-47e1-ab8f-43c7bd107ee1", "value": "T110646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300030, "uuid": "e0b50778-be93-4c03-addf-f73da69a6a98", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300030, "uuid": "f991a79d-184f-4ad0-bcb6-1effd1069616", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9s:p1iw7gryNkSV1hy1Z1u2JLu9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300030, "uuid": "c60b772f-962a-446e-b611-6815dd0e5c5f", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300030, "uuid": "a8fb3101-eb34-4524-a3ec-ec7aaffe6be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300030, "uuid": "6c6c0ebb-181d-49fd-91ea-c377f787aebe", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15990b5a-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300025, "uuid": "0152fcde-52b4-4a75-9f64-88fefddee4bc", "comment": "Malware payload (ConnectWise)", "value": "769d64f922698a98ac6f8e3bdac9c441", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300025, "uuid": "a94be6ab-f5ec-403c-a4d0-868c4c4f1c64", "comment": "Malware payload (ConnectWise)", "value": "c03cb8a6b478d8d820fe5ce382fc780a16f481aae179a36600ed12e0ee20a391", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300025, "uuid": "9d843226-6cfc-4622-a944-74d25963d059", "comment": "Malware payload (ConnectWise)", "value": "d639afc07344a265063e43ced0364537ad2ae5cf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300025, "uuid": "d1333494-bbfb-43e1-8737-d6d4c333d784", "comment": "Malware payload (ConnectWise)", "value": "9d892b4bf690c694a507c4fb68ea765df5629fee75ad445836b847ee91336136a7e0b5ac95200cb4e4109d9d93c81d82", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300025, "uuid": "1561ba26-e6ac-4314-834b-b9ca1041cbd4", "value": "T1CC646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300025, "uuid": "e9d3572d-2214-4e15-9de3-af265cc4ebdf", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300025, "uuid": "28b9a4d5-9c71-4c8c-9b49-ff5820dd72da", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9ZS:p1iw7gryNkSV1hy1Z1u2JLu9ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300025, "uuid": "91df96c2-7ea4-473c-8003-98acfecad2c6", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300025, "uuid": "8e19f24a-917e-4eae-8e52-0e3ab610a37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300025, "uuid": "9dcf1700-ef0b-4f8f-b0f7-b81e3157888e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c5068c-5d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300569, "uuid": "0e57d288-7f88-44d2-9706-ba58705645ac", "comment": "Malware payload (ConnectWise)", "value": "b50ed9700bf36fa4dabed3e45683f596", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300569, "uuid": "24accefd-87df-49cc-8005-80088ebd4a40", "comment": "Malware payload (ConnectWise)", "value": "c0eaf4eafa4771cf734c81e38ad0c1fe7cd2de3b97e23e07ebe822dc2bac43cc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300569, "uuid": "eb4dafd2-384c-4b27-bf1a-3cbf2a830e90", "comment": "Malware payload (ConnectWise)", "value": "54f626732fe232255d513bcb781548a49de0b207", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300569, "uuid": "40966e1a-6243-4ef9-863d-8b4ebf9a2010", "comment": "Malware payload (ConnectWise)", "value": "d7fa9c012783fc9399e5327585ab32452b2b8845ec7436ad0568b8a713aea2e62a864a1d7ba671519ece8ab4dc03395a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300569, "uuid": "51f134cc-becf-4948-9f7f-127e71ed7c13", "value": "T14546E101B3D695B6D1BF0638D87A52696774BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300569, "uuid": "72cbb945-ca20-4491-b4e6-342900048a7a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300569, "uuid": "31bd1a9a-24b0-45c1-bf50-8162da31e2b7", "value": "98304:+zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:+hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300569, "uuid": "7114cd1d-203d-41d9-8286-6a17d18e0e9d", "value": 5680216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300569, "uuid": "56c5c896-e382-437f-8ce8-698ec00675ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300569, "uuid": "47798b14-5ef9-459c-a781-bae29c31fb16", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c674ce27-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780300322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300322, "uuid": "17461bb7-73dc-413b-a75c-137be83b72d4", "comment": "Malware payload", "value": "b0ed34e4d9a3a14de4d4ab7f046264c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300322, "uuid": "27d1a763-c49f-4088-bffd-9a96724e741a", "comment": "Malware payload", "value": "c0fd5e93a813e72530c9051b47fe7acb9cdf2f6f1d5b17606dfc42e849fb45bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300322, "uuid": "a3dff73c-65d0-4529-8090-caf7d62c6c64", "comment": "Malware payload", "value": "f958c2f074205c07192381aca88b354ab9594f84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300322, "uuid": "16ad46a2-bcd0-407e-a523-d47f55598d70", "comment": "Malware payload", "value": "61e1a52a9285a06cf3b2d09393f788ff15d91ae5cd4adb6daa007cbf7ec7f1bd664d67512f3b477c3f2a3887591207b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300322, "uuid": "838379fa-d475-4a44-8465-8a7dde2363a3", "value": "T123A68CB3905324D8E1A989B4D11416527DBC3C8B5738A3C7BAC471F65BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300322, "uuid": "a55797fe-0927-427f-b0d2-2889bf2e02a7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ+:cqYUQuVDt0TZEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300322, "uuid": "d3e71819-0240-4cb8-bf2f-7c8696ea4632", "value": 10256384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300322, "uuid": "ead5c0ff-7ef9-4ce7-a482-b61b0d44ff3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300322, "uuid": "0ade6eb8-7117-480b-94c1-6e685477143a", "value": "c0fd5e93a813e72530c9051b47fe7acb9cdf2f6f1d5b17606dfc42e849fb45bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db05926-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322399, "uuid": "ee02ee05-3077-4ab9-b717-0810aa7ef085", "comment": "Malware payload (Mirai)", "value": "807ca01200c9d5b3580342c29f4ec354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322399, "uuid": "c7b14413-7f18-4644-b5c4-b4b81af0c8d6", "comment": "Malware payload (Mirai)", "value": "c2adad11b7b3c7a09ab395b74738b5d3ca199ee1167738c5a41c81dfa60496c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322399, "uuid": "1475b005-7948-4d59-9338-bc0542bb8e19", "comment": "Malware payload (Mirai)", "value": "1c1526885d15dbf2ced8249a4ae84dfc087520cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322399, "uuid": "9b58bd02-8ef3-42dd-9f21-2ebce4972713", "comment": "Malware payload (Mirai)", "value": "0b86f14dac2c91487981298270df3478d3a68db01ccce113605943c1f39d2593e9a0d0b1b772b22c9fb1d0d83dc3766f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322399, "uuid": "4693eacc-c2f6-42fa-81c6-9b8f0d8cf23b", "value": "T1FE834A0BB98140FDC4A6C03957BDBA36D833B4EE1239B25723D8EE396D55F210E19C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322399, "uuid": "755f6228-707f-4aff-9ced-13abb7865255", "value": "1536:PwlTmnX4OVqWKHxpvUxOMZpKcP5OtMz8e4KfbsLl:IaXVVqTpvUpKcBsMz8rcbsLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322399, "uuid": "b82a1060-348b-47dd-8a58-9a732d6b5165", "value": 83792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322399, "uuid": "fe8474b4-ba85-4bf9-a73a-5e5270f04263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322399, "uuid": "449c32ba-7364-4c35-be2f-3232d8f42d77", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ab0e36-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "77fc6951-9fa5-44ed-aa7d-a84ef104c6c2", "comment": "Malware payload (Mirai)", "value": "da497266ee83cb2bae8c7db99fb38166", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "ac81e8f1-f8ee-4702-a9a4-7116c0dff1a4", "comment": "Malware payload (Mirai)", "value": "c3ba3af87d1e38db43ef5613a383b42799494c992cb52ad55d70f3e2b10bb6f8", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "e640ef55-6c2c-410e-a74e-685e7db36fe0", "comment": "Malware payload (Mirai)", "value": "b5520607cafa2184d7b9097f520b6a496c60cd71", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "cf1ad4e7-d93f-4df9-9087-7782ac9b5be3", "comment": "Malware payload (Mirai)", "value": "b6d3d85d428d99912cf8535420491922cbcd538669d76e05f47f5d5ef38abf63dddb6f4d7f80c0387f9aaf720a0be520", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "aa02cbe7-b545-4d15-8602-982c50e727a8", "value": "T1B713F1736426E83DDE605C7A8E77C206BAF3162872AF223B14D43061E6964065AF43DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "06993d24-c2d1-4950-9058-a6541c341666", "value": "768:atGv5T33hqWcXGTy+wgmOMm7EEaIvRx1Kuq1/6X79aLs3UozmN:a4FEXSy5gmOMyEEaIvL0uqMXlzmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312398, "uuid": "d200b384-cb03-4ead-beaa-e75ba7de6175", "value": 43128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312398, "uuid": "480a21a8-2f98-4779-b71a-9bf16347887a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "cacea5b2-0a0a-4560-8cc9-32d81307dbed", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf7f414-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274266, "uuid": "739738c4-b406-44cb-b901-23034c85e864", "comment": "Malware payload (Mirai)", "value": "ce693d0f87533c5900ad99901d37dc0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274266, "uuid": "b89adeab-8eef-41ce-a71e-f90e317b514e", "comment": "Malware payload (Mirai)", "value": "c60a4258b7e45660a14ac4a033bda28678e8fe7b2e447e54a6e230ae83d92774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274266, "uuid": "58525359-d3c5-4675-b9ac-3a31015cf0c1", "comment": "Malware payload (Mirai)", "value": "1465fc1ef0b1d11fb8d44e8c3764f68170c1f2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274266, "uuid": "33cd2c1f-4358-4af2-a333-d97b48012b64", "comment": "Malware payload (Mirai)", "value": "04916cdd2632813f3e58edf28af175ddbe7a1e440fe1895ced469e4301ac75a05258b588b3c6bb659978155253b95c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274266, "uuid": "e4559774-7b4c-470b-a33f-4ce327e6d0d5", "value": "T17482CF61169A6E61E570D936CA6CCB55632B4B78D5FB33E22A014375CAC508EF2FC30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274266, "uuid": "6d66adbf-d2cf-4bea-8f84-f91d46c8ccc7", "value": "384:9k4/Sf0BYVZ/KyXbtHGRRfcI7t1hoNNkhymdGUop5h4F:9l/epZ/fI8IR1hns3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274266, "uuid": "07ded692-c48e-4080-8edf-9baeea8421fd", "value": 18048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274266, "uuid": "fbd036b8-0d48-4e93-a2f4-ffda7d3af960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274266, "uuid": "6508ba8c-5f1e-4ecd-800e-a36b3d2d625b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6276c504-5e06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780351693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780351693, "uuid": "3a755c16-0f83-4c83-af0d-0e7290a0a40c", "comment": "Malware payload", "value": "2c2d4af2c5af79ab2ba9a6fc4a58d1d4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780351693, "uuid": "145948c6-db65-4e27-9ff9-dbd32f6947a8", "comment": "Malware payload", "value": "c6630dbf8cfaa844277f4d3c5dd2c0e16c4ffe11bae1e17eb2727de96c08ca6c", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780351693, "uuid": "6ff82a37-bc1c-4ff4-a249-6d91004407ea", "comment": "Malware payload", "value": "e1538bcf73e376ec889e5b392c7afb2fa670d8c7", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780351693, "uuid": "9ad96acc-e3ac-4f9a-866d-66aefe97274c", "comment": "Malware payload", "value": "a542d0aecb3699d55edfd36448ce6df69f6e76fcffe1d7a877c9973e3ea42abf7df6fa72653bcf1688e3b159ee09cf51", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780351693, "uuid": "102cf9e3-5e8c-4693-96e2-12d7a33df1f1", "value": "T1EE26338365AF7E32C37055BC615BEB343BD4952B88A6B288D0BE1F438579F9113B5232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780351693, "uuid": "398de3cb-d68e-4001-baaf-9feaf433d57c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780351693, "uuid": "eec985b8-b0fa-4cd9-8133-20b643afb99e", "value": "98304:sMpmAYciYYOpPtPnhWFK0MF7wv2lB74U7xIgbLs9:hm/Q9tPnhESJsYssxImk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780351693, "uuid": "d70ca58b-7bca-4e21-a6d1-6a4fc4cc24c9", "value": 4542464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780351693, "uuid": "9e32e563-b3b9-4590-9e99-0a60e255eab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780351693, "uuid": "04270409-a2a0-469b-9c1f-d295e1f8ca8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cb52b9-5db8-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpStealer)", "timestamp": 1780318364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318364, "uuid": "93d736ef-b6d7-44ed-a2cb-4b4436c3152d", "comment": "Malware payload (SharpStealer)", "value": "6c33a5840b2096b43ef2a8a6efdda8d3", "object_relation": "md5", "Tag": [ { "name": "SharpStealer", "colour": "#4190D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318364, "uuid": "278beafc-e649-4c06-a6b2-9ae248405fc1", "comment": "Malware payload (SharpStealer)", "value": "c6b49419555504792d3795fa858bbc6e5de8f93054bacd0245f6101f72b4ba6a", "object_relation": "sha256", "Tag": [ { "name": "SharpStealer", "colour": "#4190D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318364, "uuid": "f06aea68-dd10-4bde-b01d-63e473f10fc0", "comment": "Malware payload (SharpStealer)", "value": "f432181b7669c4da558d4d56b78cd74f2511aeab", "object_relation": "sha1", "Tag": [ { "name": "SharpStealer", "colour": "#4190D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318364, "uuid": "d6891c59-47a4-45fb-85a1-36e281deff38", "comment": "Malware payload (SharpStealer)", "value": "f49a8ffa7e1abc508734fdf635490ce3772ea7bad40e99d5b717a97486643bc00e3fe2d2fbd77052039a737186fa4f35", "object_relation": "sha3-384", "Tag": [ { "name": "SharpStealer", "colour": "#4190D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318364, "uuid": "73c26091-d4bd-46a9-bebf-301451f08a08", "value": "T171941193B78C1332D90101B6E28ED3E68BAED5DC3277252554FCC51C22199EA83BB7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318364, "uuid": "4d32513f-5437-4e0c-a277-31c7ce95b63e", "value": "3fa2ee002680a4fae57f630b26bad184", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318364, "uuid": "f47d1550-3570-4d19-b778-b912cad26fae", "value": "1536:Z4fj47EtffD0pRLnWU1KSFh0c6obK3r3fAJr76vfyL622z:Z4cADoRrWUgSD3X4Tfgkg6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318364, "uuid": "e786675c-ebcd-47fb-ac9f-f5b71da50dcb", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318364, "uuid": "6d58d036-75bf-4507-84ed-02f99d5bb8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318364, "uuid": "2aac8862-0896-4a11-ae59-ddbffd96fad9", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f16fad-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "984e9d83-d6a7-4bf3-bab5-7297806795f2", "comment": "Malware payload (Mirai)", "value": "f66b135005c5b434728116aba2503026", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "0b1c58da-a13d-4ff3-a331-5f4699f4d1b1", "comment": "Malware payload (Mirai)", "value": "c7395e64995437727f25a648fb0b8dc7dbca02cfc9a3bba463f8eb7f1f0068f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "2457e09f-18a5-45a9-83ce-323878b49900", "comment": "Malware payload (Mirai)", "value": "01874d25a924521425caf056286ab418f8fc3c61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "e1c4a0f8-9483-4a33-9c57-835310ab878d", "comment": "Malware payload (Mirai)", "value": "cad8a672a3a966aa3e536ffcba6a0dac584994aff9e97198a54ea87d5bf937c1eb299bd08094109baa798f1ed49c032a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "fcb95225-16e0-4953-bc6b-81f0ac90250d", "value": "T1DFA34A9AF801DE7CF80BDABA04170D0AF931A39116830B37676BFDA3BC721B55916D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "13864c0b-5191-4313-b9af-5c1217d0d06f", "value": "1536:NU6qhmloc/juH6qt8dr6ymO1MUVa5gqkGSEn7vFr3watv:NLSc/6H6qvymO1WghGDNltv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292328, "uuid": "3e6e219d-09cf-4301-8651-e270497b90e2", "value": 106772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292328, "uuid": "4df6a0f2-c657-4ceb-aeeb-fa270b96d5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "3f2ed0fc-0a83-4c8d-9eb5-df5f189cd539", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f782e3e-5d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780279050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279050, "uuid": "e1e48df2-e190-4d60-9a41-869f0484505d", "comment": "Malware payload (Mirai)", "value": "cd65e807da16aa82676315ad1c4eb722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279050, "uuid": "4302f1b5-dbf1-4ee2-b53c-f9c98c5630f3", "comment": "Malware payload (Mirai)", "value": "c7767de73edc6fee9c26dd927051bd131f585432c6357d2457f8419fcf3186cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279050, "uuid": "439cafba-46da-442c-b217-a6e955c51162", "comment": "Malware payload (Mirai)", "value": "3fd5883044d4078476e25a09ff4ac55c2a5bd414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279050, "uuid": "87b07e43-fdff-40a4-912f-7bbfcc30c568", "comment": "Malware payload (Mirai)", "value": "029589053bd3dcc31304812da0906b1750344007ff6489bb5b80e796a4cc55891a85922be644e686a787f131dfe24328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279050, "uuid": "5cd19a29-58cc-4bc3-8187-c7ffe7d8d1b4", "value": "T16B535BC2C643D6F5EC1122B02437A7225E7AE53A6739F916E3EA3A376C13B50860735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279050, "uuid": "28282d14-3658-4a4b-b16d-5a35672522cf", "value": "1536:MWP4zC4G4EQOqMdlxtn8Dxe98apta231+vx7k3IuwggKsgtxBk9:MWPu1EQOqMnxtnm498uta2a7k3TwgGUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780279050, "uuid": "39e3f9fc-ec25-4190-8a47-9a7823f9d6bc", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780279050, "uuid": "0827de5b-60eb-4292-b2ed-baf53e8f0003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279050, "uuid": "bef1b7e8-302e-4d8f-b1f3-e794318c18f8", "value": "c7767de73edc6fee9c26dd927051bd131f585432c6357d2457f8419fcf3186cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439ea3cc-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "0580c6bb-fb25-40cb-955f-1f3f4f74443e", "comment": "Malware payload (Mirai)", "value": "5e8df30eeda00b504307e16b2a1fb523", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "055d7513-84a9-44ac-8c0d-5656356c90bf", "comment": "Malware payload (Mirai)", "value": "c783604faf5a89d9043ce771d71059ad37160cc0f2df8c9df67e50626f3f184e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "12fccd97-104d-4f6d-9794-95a981506f23", "comment": "Malware payload (Mirai)", "value": "5b52cb79beb53b017461e9cc509b087d50a53f23", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "ccfd07d4-6ad0-4f20-9b25-62bee16ecd2b", "comment": "Malware payload (Mirai)", "value": "f2da52d34128620f4b6eda1def61d18fb5da30e0c46a2b23653dfb58b991a7ca0b6865c5c0818dbe3784fa75dcc083ec", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "5cd10783-5585-4c62-a789-9295de6ae4f8", "value": "T1CB83AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "7b15503a-1485-4f0f-a658-7c20b26386e2", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7mb:UeAsdukuhoNJVwbmuUqjLjwWimb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291512, "uuid": "ba85c76e-726a-4cf5-8fcf-5ad5cb3ce02d", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291512, "uuid": "3c90b7fd-abe7-42a1-8b4a-6061eac6436f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "c8f92bcd-1f5e-4c53-bc5d-733a6826e028", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a80637-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274311, "uuid": "ab7877cf-8653-4bb1-b766-484668c75c3d", "comment": "Malware payload (Mirai)", "value": "33aea65c8d359fc1feec21948b986280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274311, "uuid": "3842f043-c13e-44e2-a57d-d5c6db156f94", "comment": "Malware payload (Mirai)", "value": "c7b4daa0c1909087c07f8550dab10224d8719ec6c704451c2d6b1e7296859dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274311, "uuid": "d07b58f9-0a95-4add-978f-578e8feca69d", "comment": "Malware payload (Mirai)", "value": "0c4c8b7a0869571e0a6ee046ca3b5ac0522d409c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274311, "uuid": "7003dad9-90c9-4b15-bb08-f631d3dab853", "comment": "Malware payload (Mirai)", "value": "ad84bdabe5811956aa944d19709ad6c7b03943b31e121039b3339214c3a0ce5f0fe7b3c188b2a599f22f2a5cdb890b68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274311, "uuid": "a6fbe1fa-4625-43bc-b638-90401d6dc1e3", "value": "T16F93B81E6E219FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274311, "uuid": "9fa73b3a-6ed1-4466-8ecd-5ae84540a5f2", "value": "1536:KloXJI3TfgvWcToqXXgLAHw3AGh6zeglH08kYf:KkJIDovBTxwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274311, "uuid": "e61143f2-06aa-4463-8027-c0d2d50eb68b", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274311, "uuid": "8f725f1c-36f7-402f-b13f-113b15462e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274311, "uuid": "df96a638-c69e-444d-b727-05a0c6a822e2", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ab76ce-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "a1dc2f3a-31f9-49da-b422-f45f363943f7", "comment": "Malware payload (Mirai)", "value": "4e45aba74d0de02ddbf3df7eaf4bc026", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "ad7e1433-abad-4b22-aab6-d648226894dc", "comment": "Malware payload (Mirai)", "value": "c7b9ccb9b1cb94f53237d16c6b20348fbb26a260d4f78b1aa2085fe127e88a56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "8b2c0f81-4114-487a-9bec-c78c371d3929", "comment": "Malware payload (Mirai)", "value": "a8f7f4262f5c40548934eaa84e5f0a8fb5cc1dea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312398, "uuid": "bfab7a74-e4b4-4807-b3f3-9ff732ff3a54", "comment": "Malware payload (Mirai)", "value": "ee4597f579e65eeb633772920f05a4696a5be41e9a0c4c6d6eb7ce392eb60e084eb02d0c1733685852598fa1b0b4b920", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "e0f42750-47c5-4af8-8af0-b83d3c1ba593", "value": "T16AD3AD9BF38B04A0C86206F007CB4F9E2D6361C25F5BD5E77D29A63B6E760DB0905B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "af743732-bb01-4409-9838-9ec567f7585e", "value": "1536:UhII0zLaDeZpj7zZuuBDJ4J6kPFln/hHNgBx6U2gn5l+/LWm:7vyq3j7zZuWDGJ6qnHNg8gnD+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312398, "uuid": "f094dc2b-d19a-4cb5-8f26-20e88d0b4c3f", "value": 132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312398, "uuid": "c58b75ee-b3cb-42c5-bbca-0287c6d62715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312398, "uuid": "c7a45c50-b66e-4032-b914-67f9f34c24a4", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51dc7e9-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292991, "uuid": "aa307259-2913-44b4-8e15-09de6bf6ef24", "comment": "Malware payload (Mirai)", "value": "a65ccbfac5ac07799f49634f72f26b88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292991, "uuid": "f1085c31-d272-4a53-9b9e-584f5369838a", "comment": "Malware payload (Mirai)", "value": "c7d21bd199ca4115172e17d42bae8a1a3d486307f084c3312408019e010d5f20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292991, "uuid": "35a323c2-474a-48d8-8779-b2a91dd21068", "comment": "Malware payload (Mirai)", "value": "ca81b72998bbc480d75a2fcc3031510ac2784a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292991, "uuid": "48f02648-5607-4575-a186-1343ea254d0b", "comment": "Malware payload (Mirai)", "value": "a55806c22ec9b96b85bfde69417de7d792b767cfd118bdbbfcb5e5f88fda9be3fbf2e4bb8475b6b7ff409c6b3e1b1bdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292991, "uuid": "10bdb421-e6d9-4d5e-a633-b0cf01241dd7", "value": "T1CCD38248ED68A73DC3E372FFE75902CE732A1B9877D671258E324A5637C8B95A434120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292991, "uuid": "eb64be73-f77a-49b4-bf77-fd00263e14b5", "value": "3072:TfwjrYa8FQiNnQk13qVqyD76tqk7iD51E06Hh5ZC5M5b2:Yc9OA0E5C5M5b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292991, "uuid": "aef10fc9-7eb6-4554-902c-f799bc3d5f85", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292991, "uuid": "e5520426-0fd8-4109-8b54-a21ff8ab9704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292991, "uuid": "9893eef6-4710-4cc1-b378-8560a8f19525", "value": "fvgbh.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3b17bc-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "4b6c7afd-fad2-40ab-92f6-8a9d43fd12d6", "comment": "Malware payload (Mirai)", "value": "1cefeef522bceff3e89421a1450ac0f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "ee32f60c-49aa-4f4b-b636-c2d5031ce807", "comment": "Malware payload (Mirai)", "value": "c8010894730cbf62d420591cae5d92cf2bc91d36241826a86ba90c6a8ad58082", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "985524bc-3b86-45f4-a3db-b53ed55b9022", "comment": "Malware payload (Mirai)", "value": "ce83445c1889a0812579e4c1dfcab2593d99a5d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "2b8bdb72-8b7a-487d-840a-c908e5f24695", "comment": "Malware payload (Mirai)", "value": "a351834611f15a42d07ce19f64f9afd6914a8476dfd661a50c51266e30aab49199030131efee399867022c27f6696abb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "342b3f51-3e6f-42e4-9a81-04e02a607120", "value": "T15D939E26D0146DA4C49686B4B0E8CE751F63F0C843572EBB19E5C2B96893DB8F905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "b709131f-950c-4e9b-8149-7553d777eb99", "value": "1536:vZOnLRoMikpOQqfFbYYhv7y7KGzJWq7RaCeeIQAdb:vEnLRRikp8FbLFy+GH7RaaAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292330, "uuid": "b5acb9ae-e27b-4627-bba8-f38eb6728b33", "value": 92172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292330, "uuid": "c6c9f333-4dd9-4e84-ac14-af82617c50ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "bb38b4ce-28c1-41f0-85d7-d1d9dd05a5e9", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c97bdf-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292932, "uuid": "12c45b4d-5a84-4678-a7b1-e08c8989f356", "comment": "Malware payload (Mirai)", "value": "aee0327149071841c02bbb16a10eb9fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292932, "uuid": "61454eed-f1d2-484a-b1c3-1aa919bd88b2", "comment": "Malware payload (Mirai)", "value": "ca51121f166aa36b0e10512dcea21b19e088effadddbc822d118ed3909460904", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292932, "uuid": "70e2e527-770e-48f8-9a27-6e82ea6f357c", "comment": "Malware payload (Mirai)", "value": "2d1cd888d14c1b59434907eb1d8f5a904731ad56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292932, "uuid": "baf37db1-ee3a-47e0-a947-2b8b84aa54e1", "comment": "Malware payload (Mirai)", "value": "bc56ecb0596f12372c0471fe3dc6b255a4f9767f1eacf7c6a68e637c01110308aa5dc69a918c0fd292a4aa554beb9fdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292932, "uuid": "728935c7-0dc3-4d5b-9225-92a9448d3bd6", "value": "T187533903F9E250ACC542D031475B9A2AEB747C4803267BDF67C4BAB53E75E907F6A260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292932, "uuid": "69ea89f6-b611-46bd-b4b3-fce2c5451164", "value": "1536:4rNZYLIFsxraeb6TSBlvqr79Q7yy6NQ3kA+lK83fC2qgcpZNG2kV+3Mn8N9z8h+A:g72osxl6OBlvvFI1gcUrAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292932, "uuid": "331863ee-dabc-49a0-995a-ffe656471df0", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292932, "uuid": "2c51aa70-dae5-43f8-a299-5bc7c0fc5e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292932, "uuid": "627f819c-014e-4c49-8c8d-93cf2fe4a26f", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4290aeae-5da5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780309979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309979, "uuid": "b0917148-7afd-4178-a71f-928078fe33c5", "comment": "Malware payload", "value": "e537174517ba98295fce9dbc4c550202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309979, "uuid": "f8f59f6a-9497-4d80-8779-2c1345cc850c", "comment": "Malware payload", "value": "caabd529170bb24373b8cafc7d3c55e2efa88322daa2e7ca3c31de194f64b193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309979, "uuid": "0096d7f5-927b-406f-b9e4-42cb6132f18c", "comment": "Malware payload", "value": "459181df03e6b9cba0b3e11a625e56dae8b8422f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780309979, "uuid": "3f38d135-2c1e-4b91-a8f6-eeeea79965a7", "comment": "Malware payload", "value": "7b46489390411893c98cbc1a72f5308817fc2ad03b84fc0606747f5549c23a1114f90f5f757504ecd35ac95f505745fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309979, "uuid": "c1b78d03-7788-46ce-a0da-acf6901e24d4", "value": "T129D1B70163FC862AE5FB4F3868B353191A75FE014D72CB8D5CA5420EAC32B258E61BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309979, "uuid": "2f6deccf-e7a9-499d-b73d-7bc524e76f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309979, "uuid": "012230d3-73ce-4946-9761-bd7e665aa7a7", "value": "96:/ZnRletEvWIW1hBM3K+TVw790jZlm/xEowtCq38drvkOMEEtOMlC:dXMeWP1hApVW98Zw/9dIO8tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780309979, "uuid": "c5b47497-0851-4d9a-b1b1-87984609386d", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780309979, "uuid": "5a940321-4abc-42e2-849f-da9eb003fdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780309979, "uuid": "389c807e-f86a-4f88-9d87-6cfb3e93ddb2", "value": "alteracao-39387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dc110d-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "717a840c-1ce4-4265-a626-f00ce98d3bcd", "comment": "Malware payload (Mirai)", "value": "6be4651d528427e32e413f2a0ee90a6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "42d76546-b0df-4c0a-8e72-ae43cbaed6d0", "comment": "Malware payload (Mirai)", "value": "cab04ea015a6260a1dede7f2df4162e43743890e45974bc38b79a3e3e0534037", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "7e732061-9639-4ee1-8beb-d866e4fa9d6a", "comment": "Malware payload (Mirai)", "value": "35ad80efbda40eddc941b59a9491a867e96fb1fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "6740a398-d753-4590-919e-e68bbb2c2ebe", "comment": "Malware payload (Mirai)", "value": "09b76f257ce71d14ae962b39246ad381dafd1cf3351f8727e4e32ccbd142d9c822ae586c450c8d502ec717dbeb7a11ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "6fade575-591b-4174-9b41-01e54651f65a", "value": "T133D3AD97F38B0551C82202F807CF5FDE6E2322C26E5B85E72D2E653A28790DF4906F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "9fe0cee1-b4e8-490e-a9a9-0f9f3b774300", "value": "1536:k3NA/f3A72dILzQJ6yzGPHtOp4UlMU71nVYgXM/LWR:yWY72OwJPzgNOp4UX71nVYgXMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292328, "uuid": "313931a0-b73b-4746-bcf7-42b78824c3de", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292328, "uuid": "472f58cb-1192-45c5-b234-16c8f995046d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "6cef4e2a-bcd8-419c-ab45-e8333b712ff0", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a94757-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292428, "uuid": "e984bbe2-2132-45c1-91d9-185ec23039d5", "comment": "Malware payload (Mirai)", "value": "efc1b091c9773e15ba3296d489c78ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292428, "uuid": "120957a5-f841-4f8f-b7ed-17338bb03fa4", "comment": "Malware payload (Mirai)", "value": "cce06c613759112c5a73631102a49b7c62eed7d559057ef549b83924615f65de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292428, "uuid": "6b3fec0d-f654-4403-a637-2d57401bc93a", "comment": "Malware payload (Mirai)", "value": "f92a0bcd20d34b4b43ebbe80730fc6720a892dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292428, "uuid": "553b3b04-f1f4-446d-998d-2e1893e71250", "comment": "Malware payload (Mirai)", "value": "25ab7003a6a94add5c308a4b2c86b56f06de9d5bbf69381aaac1ed189c591a7a0d9789aca2ba9fe41c600262b015c86a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292428, "uuid": "95a4fb0f-1c7f-49c3-8df0-7bbc39ae415b", "value": "T18E936BC5F583E9F5DC0705753132FB378AB2E1FE212CDA43D3B99A23A891652D405A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292428, "uuid": "5f8af319-85ff-4f66-918a-3b9ffabeccaf", "value": "1536:Bfw1E2o1fSKlk7HwDAbBWlBpJiqt1SI4QgM/g9UH0ajiXr8bQ/:VwKfSKlk7HwDAbB0piqXb4ZM/cUUYpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292428, "uuid": "b9b3c179-dc16-4cea-945e-362febb98ad7", "value": 91216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292428, "uuid": "511d0b7e-e99d-4402-b5ec-e9edfb582563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292428, "uuid": "eca88d9d-8e90-4ce4-a814-8840bd38339b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164997a3-5d52-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780274256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274256, "uuid": "4ab8993c-1e81-4fd7-a4cd-50b65fd8ccde", "comment": "Malware payload (Mirai)", "value": "f81bcb636cdbc910cb211f83a4443e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274256, "uuid": "4c08d69b-d947-4f3b-b1bd-c4968e8ed0ab", "comment": "Malware payload (Mirai)", "value": "cd1e19311bb228baa489ee9dddc6b42245ede70c43c784f7575b50798a46c614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274256, "uuid": "b1523d6d-e4dd-4098-bb94-8894fee6519d", "comment": "Malware payload (Mirai)", "value": "05642c5c536251fda7c6223c8f788bd3887e5641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780274256, "uuid": "4fcfb788-ce2c-47b7-a00e-88c0a98376a8", "comment": "Malware payload (Mirai)", "value": "84fb98f8bd1763a08c15634b0eef4b8158f21b923a04864975950120214f58071e7da6062d83448c25f8672229e2a51f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274256, "uuid": "00e365cc-ff64-4e34-bc1d-a720966ff245", "value": "T19DE2F18A88DCAE0ECA6553BC556EBB40FA15A4A42F5F53016ED5CCC2A8033F5F531933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274256, "uuid": "1c8bc53e-68e5-4bad-acf7-fe1310460712", "value": "768:WBbVkTrCrlV46JCSVO0smsL0AjDTK1xtltOD:KpqADsLjPK1xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780274256, "uuid": "9e9ac5dd-fec8-4f08-9ed4-9143904f4fa6", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780274256, "uuid": "b09da844-26a4-49d3-b16b-7a7452c7fcde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780274256, "uuid": "4eb48de7-0518-4577-8707-3d44cd26bae7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d1b1e7-5d90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780300997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300997, "uuid": "ebf8fd70-9a8c-495d-8f20-925c8be0bdd7", "comment": "Malware payload", "value": "203f6b8fe59b60e8f75456a760e5c8eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300997, "uuid": "3d7f1cd4-3ec8-48b5-aa82-20dd2674b6b9", "comment": "Malware payload", "value": "cd4aa230c7750f57d17620b868607f7228b4cda756d63c9fa86fe2c84fc11b45", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300997, "uuid": "59facd1f-c801-48b4-ba45-fde810302a9a", "comment": "Malware payload", "value": "1e58c8b08e554b9b867ac3373b2b884dc30b44de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300997, "uuid": "b28bab09-5239-4511-8295-cc85b0308f85", "comment": "Malware payload", "value": "30b00c186469f4e4de78467150a67600c22b49f6d7c6f9e9ccc4ac72459fc16df4ee48c600abc24442b377c263bf5827", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300997, "uuid": "8a099f82-a63f-4c96-b080-ba71c4d25d41", "value": "T1AF136D6526953C25AE99883B5D7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE318B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300997, "uuid": "507cd526-d450-4449-a01e-2df7b1b93f0f", "value": "768:R6r9NyXsZztCS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:uHusZmcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300997, "uuid": "0db9bd04-4969-4ddc-9cc4-c416006155ce", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300997, "uuid": "9a85db3b-a9c4-47d5-ab0e-3ffc29bdaa21", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300997, "uuid": "db56a1e1-d0ee-4501-bf18-8dcb48e239a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3edd22a-5d97-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780304183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780304183, "uuid": "9e346f9f-13cd-4a17-91b8-f8dea9100364", "comment": "Malware payload (Formbook)", "value": "76caaf122e570993995caca886467621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780304183, "uuid": "3577513d-34bf-43a9-a17f-61edceeb43c4", "comment": "Malware payload (Formbook)", "value": "cf2471d843cae60503efb1db4adc57e5f64ddf67ee15ee9314b4e9caf90bc309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780304183, "uuid": "bf117c3e-6fa2-4139-9b45-9f8f935db909", "comment": "Malware payload (Formbook)", "value": "d371199fa2836cead7b9b53af7f64f961f02586c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780304183, "uuid": "e8b9819a-750a-4245-b058-e985302ada8b", "comment": "Malware payload (Formbook)", "value": "829b3d060b308543d7b98c8be59b745ae7e2c50839483e1dc7be017c287c75fa7c67b0c3a1586c25804d4655d3d3bac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780304183, "uuid": "6579e130-7d54-4c25-95a0-3544037d0df2", "value": "T1973501112A94DC41E9BE0B7845E0E37207F54E1DA412E3269FE5BDEB3C367959A0F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780304183, "uuid": "44877933-dfc3-4627-bdc2-532d7ce785d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780304183, "uuid": "d6801d0b-a022-4d87-ac07-554190fe57df", "value": "24576:fM1H8+goDqT+GpMuNCLI3tRHKlvNtuXAAJu/u0YOHUuU:CHdNuplCstMlSXAABOHUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780304183, "uuid": "66dd1710-ec7b-4b75-8242-96a7fc0b058f", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780304183, "uuid": "7c4b749c-6259-435f-a2d7-a9aa8f0ebfb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780304183, "uuid": "1e037869-e31b-479f-9daa-c14d4ee1eeb1", "value": "MT_Caribbean_1_Vessel_Q88_Information.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b24223d-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "244c496d-7917-4d2c-b062-1a0451be0ec7", "comment": "Malware payload (Mirai)", "value": "6a85a7ec2b0ab6921999338794b56490", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "b25ef1a1-ecd8-4aea-9a74-2480032d4d10", "comment": "Malware payload (Mirai)", "value": "d05519da897fa942cd63f3b05257dc850deee869a188b2faf25c5f54d9a4effa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "3b088a8e-3806-41ac-ad1b-2fc97e2526d1", "comment": "Malware payload (Mirai)", "value": "fa735b06d37649ddd702acd30923dffacd64f52b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "e82eebbb-5354-4593-ad44-3de188323e2f", "comment": "Malware payload (Mirai)", "value": "bd29f67ebbdd36fabda6190c1debf17c949b10901136b459f7e9339a66427564bd014d7c6fb03e58c55787e24fcda2e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "bfcd71be-5373-4e23-a2f0-4a6c2241510a", "value": "T10EA34B21B9391A17C0D5647E21FB8B15B6F257CE2598C64E7E720E8FBF216403943EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "f69aa903-9ddd-4cf9-ae38-79abebd63474", "value": "1536:Djej6LciSSezdYwxWu/oxCOfcJYPbn5sRqnMbnaOA51w3tR8i:XcUciReIlbnqRNaPin8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292330, "uuid": "75dce279-696f-4db2-ad2f-d4f172ea588c", "value": 105576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292330, "uuid": "90d34f2b-c38f-45e6-8c6a-e4bfccf4cedf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "6a49dbd0-6c8f-45cf-9b03-ef8e2af6086d", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073ae493-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322335, "uuid": "9cbcffd8-6ab1-40bc-91cf-ffb3513421bc", "comment": "Malware payload (Mirai)", "value": "3525c2df68f139ee92a0ab8cb32ecf7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322335, "uuid": "28630bfd-9aea-479e-873d-dec6a15efcfd", "comment": "Malware payload (Mirai)", "value": "d0d7e289a35968ade145fb00705e5947f62338d7a49082982387e726c823cce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322335, "uuid": "c75758f1-f0ab-4082-b732-d6db4ac4c615", "comment": "Malware payload (Mirai)", "value": "08581dfbd6305fa74ed9688262c2fb3f2342c05c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322335, "uuid": "1e2f8505-233c-4d01-8829-31a28a803ba4", "comment": "Malware payload (Mirai)", "value": "2b66fb6f9eb91c589df2fd5a65b09530a5fbda342a673d2be118b589174ba323a28a7cdcbbb6635868b99c01c37222af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322335, "uuid": "2d0d89ab-335c-4e73-b279-92043a3efef0", "value": "T1EFC3AEEBF34B29A1C86246F017C79FDE2F2322D19E5B95E72C1D163B18790DB1906B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322335, "uuid": "43b0d4ed-f864-4f55-92e3-41b41f1028ac", "value": "1536:dbAIdvORcxrHLKcq10El8rklF7HNixRBzgKMX/LWb:dsmscxrHtWKrkHHN8g3Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322335, "uuid": "6fad469b-5c17-4cf7-a5a8-ac13958c0baf", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322335, "uuid": "1a943e96-b8af-493e-8192-8d2b604c5a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322335, "uuid": "f8dec313-41de-42e6-b7ed-ece6120d22ec", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e044d51-5dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1780321675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321675, "uuid": "7723f2c3-d6f5-467b-8d4d-c0ef15a393a5", "comment": "Malware payload (VIPKeylogger)", "value": "8a2115507c8f5c2685d5803c8857dd49", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321675, "uuid": "26025cd8-4810-4a15-b828-487d4a1a1e0a", "comment": "Malware payload (VIPKeylogger)", "value": "d1a95901bdcfcc333791d88eca7514c1b3482c45209e5c53c3949d4ee4e0b9ad", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321675, "uuid": "b8c1ce58-f571-439b-9d0f-3b08d358002b", "comment": "Malware payload (VIPKeylogger)", "value": "9827af93afc92175163885e7d1815f5e5a3d3f7f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321675, "uuid": "90b02269-69df-4397-bb9a-2d9f191ca268", "comment": "Malware payload (VIPKeylogger)", "value": "f5f81b8234332fc58c802f6056ab7398450a1745057ae39c46db43406289be40bba7c892f76b288a02bb66fd03a913d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321675, "uuid": "f0801646-3413-43e3-8cca-4410508fb948", "value": "T12B81E7464B5E5E711C3F1324DA862D8D5862A3D366130892F2B413DF0286EADF7EE5E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321675, "uuid": "d6ab5f21-fd63-4669-b8e7-c50587432d56", "value": "48:Kdtc8AxZvTQeu+S4YhAUDKjBLjsCTfyHETxAIqy/QTtoQpv5Mn0jZXjY+0TakP1j:rWn+S6RtxzFxfSo6GOJY+0T7tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780321675, "uuid": "43b0935d-da5e-409f-9048-518ad464dd8c", "value": 4067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780321675, "uuid": "44a5a945-12ac-466f-b05b-2e6e334f8d23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321675, "uuid": "7ff6556b-9247-450a-a70c-379e9df27642", "value": "SCAN.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d33ca57-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "39065c54-2325-45d7-9247-541089ae4072", "comment": "Malware payload (Mirai)", "value": "d4c5b8749259716c075a902e73727e88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "3765e497-4adb-47eb-b987-876252419cd9", "comment": "Malware payload (Mirai)", "value": "d2d00feb3c2880545719f527334db081d1a4dd90f7860e59ecad8317070433e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "17c12da3-74f5-452f-8063-f3793b232b9c", "comment": "Malware payload (Mirai)", "value": "fc569e9d509456c1aaf5b79a77a2b0a1b0236d0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292897, "uuid": "ffd23079-86aa-48fa-a48b-13ab0d850529", "comment": "Malware payload (Mirai)", "value": "e53f57d4cddf11f0a95f3a86b45894788211dcf9448da11210647590a2dd2dbf8874184bec7f0958a91e4dcdeb2af8e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "eb865ce0-4796-4b31-b183-62c512b11d5f", "value": "T16563F892FA41D941C5D938BAFA2F41C833830B6CC3EE71069E01AF35B5EF9594E7A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "f1e925ff-6860-4a5d-bd8b-fa51f44ae9f3", "value": "1536:Q1rN8Blf3Y/yB2UbfCm0VOawF+rDPizTHOa/T+7:009IUbP5an/izT9q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292897, "uuid": "b63a22e7-4c6c-433d-b8d3-a19bec816238", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292897, "uuid": "ab11b41b-7e38-45ec-8192-6c54e10a593f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292897, "uuid": "1b7eb3b6-5d60-4b45-9370-2e38f888224d", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa7d18b-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297698, "uuid": "94415268-65e7-4b30-b9f4-9a612523bacb", "comment": "Malware payload (ConnectWise)", "value": "99c66572ba91972f374a4e1174c92a60", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297698, "uuid": "a35ebbf7-c2e4-40b6-8a08-7eb0f0c3709d", "comment": "Malware payload (ConnectWise)", "value": "d34f823b58007b32c593c427cdfb76faec0409036a99e1ace840b2fde53dc5af", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297698, "uuid": "ce5bb9db-8c44-418b-856d-425113082247", "comment": "Malware payload (ConnectWise)", "value": "910d46bca34b8bc90dd1ec84f261a388fd1bf10d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297698, "uuid": "dbeedbf8-bf32-4d50-b814-9a5186d1c21d", "comment": "Malware payload (ConnectWise)", "value": "251b64131322e2c31942682f5bdb818c41d19cc78575ef76da8aa7e10ee3c795bea976d98314cec6fc105202a21ae172", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297698, "uuid": "9f9cdb61-1e37-436b-9be4-b8a30dc71922", "value": "T17046E111B3D695B6D1BF0638D87A52A96774BC048316CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297698, "uuid": "24c503c9-61e5-4038-b34e-a3378e8d8d08", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297698, "uuid": "ee454e54-7009-46e3-b6fd-ebe0088b6439", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297698, "uuid": "88c52bf5-0e6f-4102-b7e2-b673d91e8d91", "value": 5693536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297698, "uuid": "5269863a-eca2-4df2-a06d-3208f084c4c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297698, "uuid": "c9f2cbec-17c9-4fde-a679-65e4578f67c9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6943c538-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "a1fe04a8-a957-4842-b8f2-941c52a5d589", "comment": "Malware payload (Mirai)", "value": "eaed53c830772fd3237c3683598b8032", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "fc2bceb0-7ea6-4df3-9ecc-327901a8262a", "comment": "Malware payload (Mirai)", "value": "d43b6df9cb7cfe7dd9eb222f9e9ed0294554cad689b91260f8da3174081a4e23", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "9982c185-1395-4a7e-b6e9-285e6c94789e", "comment": "Malware payload (Mirai)", "value": "c130044a31689941d7bb84c61e3743829f5ef236", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293723, "uuid": "654af620-8ae1-4a8f-9fac-195960dbeacb", "comment": "Malware payload (Mirai)", "value": "cfa7b8eee36a29c9646daf5a721a972c3d8667b463d838c6de7c3f99888d9c4fda547b3b6a42a5637553a4f91943c0e7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "83161659-0615-4cca-915d-cc1edcbc5bf8", "value": "T11583AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "701d4a2c-224d-43e9-9c59-022aa7784fbb", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7d:UeAsdukuhoNJVwbmuUqjLjwWid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293723, "uuid": "c262269b-0a6a-49a4-b600-d117a3986888", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293723, "uuid": "9c835bd9-8129-4d69-8d29-108977c64c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293723, "uuid": "a846c36e-aaa0-429e-b3bc-a310be895698", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf4f2c9-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "8ccb73a0-11c6-486e-9dcd-7e0ff6502c19", "comment": "Malware payload (Mirai)", "value": "6524a6087c55617d50a66fdb0543f380", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "06a7dab6-c818-4b2f-8415-bee74a9ccd21", "comment": "Malware payload (Mirai)", "value": "d49077ea86e43d2a8dc984157607684cc4e2b6cf27812985b2e0a2710a42c43e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "7846c7f0-5cb3-4014-b79d-eda868f4c5c3", "comment": "Malware payload (Mirai)", "value": "4ef6cbc831e1f1c2c28c8103dcb16f00d6df0582", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292895, "uuid": "6fd3c9a2-3642-420d-8dac-f351a7a7e43e", "comment": "Malware payload (Mirai)", "value": "af5a2cce24223d9a002a065eadfb6780d408725f8ebabdf2c7d2bcd51479f7ce3ab243af46dd60fba81239cd26d1718d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "6c161f0e-b6b8-4dbd-b021-8e6065511b6c", "value": "T16B638D808C1DF873DBC6F47E4A880D50315BBCF42469D78E4620A68EE8949A46FD5BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "83b8c2fe-790b-43cb-9da5-279136e151dd", "value": "1536:brNGXqbtCCMJpiZVWrqulyTBwmZO+raJ2J3fiJIg:Pir5pi/WaomfiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292895, "uuid": "00e6de9a-99bc-4259-b19e-c721117919e0", "value": 70512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292895, "uuid": "fc89e56c-c550-482a-bd7f-d94c99b96ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292895, "uuid": "5279e80d-809c-4d2f-989d-9f89e39bf16b", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b166c716-5dd3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780329922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329922, "uuid": "42248d1b-663e-4f4b-9a5a-4d343f4f377f", "comment": "Malware payload (ValleyRAT)", "value": "ab47bfe382546241a95f300cdd805274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329922, "uuid": "3e1e4682-9d44-4b0b-a3c1-abd6d9dd85e6", "comment": "Malware payload (ValleyRAT)", "value": "d56867554012ff1dbff99de2d1646f006db083396179f5128152eda36d598c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329922, "uuid": "067bdf46-78a8-47d3-9b36-6b9d596c830f", "comment": "Malware payload (ValleyRAT)", "value": "ce1a6f491a17ff29e49b36ae34427c2a3822d0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780329922, "uuid": "37628f2c-336c-4205-9d0d-1c2834c6f621", "comment": "Malware payload (ValleyRAT)", "value": "56b3cc6a287677a60e04c3e4f739d4d55f69b06a6f138a15a32690d53a65203b10a06da79b68dffd2d4ec249521e5287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329922, "uuid": "e650203c-c8ee-4061-b67e-1a62d39d41b0", "value": "T1C7F79E4AF751CD56D425533898EB475033B2E4A40B6BC3A3371E773D7EAB3A84EA0990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329922, "uuid": "af506b87-f447-4107-8d48-0b2fb6bd1826", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329922, "uuid": "d894a167-514c-4bd9-a69d-4da9f4b140c3", "value": "786432:fftXNlNCxdpGIpPQXRUvoMo0h3248y4kkAWOQmrqykFq+a49c:FNORBvoMo0vGAmykJ9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780329922, "uuid": "2a0e1cda-2164-4874-86d7-887a6b969e03", "value": 74043136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780329922, "uuid": "4c88c69b-c0b6-478b-833a-8873c58c9fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780329922, "uuid": "7a24d5c0-3864-442d-a28a-c9cea1ef6b4a", "value": "zmh853563201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2998dd53-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "588c096f-e4e3-4973-b6aa-be1c08b55699", "comment": "Malware payload (Mirai)", "value": "fb6be6b8407984df6a9bf3fd97820820", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "8f2ad3f9-ea1f-45c3-bc3b-570ca0538df2", "comment": "Malware payload (Mirai)", "value": "d5f651b772c567a2997eebad10b8b062191270dba3d17c99f161686bf8b98adf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "1b6b45d9-9a53-4f55-a3c1-b0a6866038d9", "comment": "Malware payload (Mirai)", "value": "0585aa0bbf46e323863b133757eea302bafa4bb6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292328, "uuid": "1eeaf2eb-8e45-48fd-a378-43025ec065c6", "comment": "Malware payload (Mirai)", "value": "a5d4d8f612a9a3fc6bb3987a69e9ca51e7a0fc248836a59b477ddd4bdb3bca77413a1308873a286a3c5b9e87fc470986", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "ed409d28-5ae4-468b-ab14-67ff165b53d7", "value": "T1C75302018DF254E2CD300D3FCE652C75BBEB4BB4A96A2056358889ECF9A14B315BD993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "33f2f8a0-f65c-4536-924c-bc476f4129ba", "value": "1536:XqakjTSkKhsLqNPhtVkFrf2FMGnL49/rLE5oPm+D1RNAYA:X1kjzKCL+PhyDOc9/rLXPm+BRzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292328, "uuid": "8a0835c0-657d-4ab8-a6de-82956aa1d15c", "value": 62944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292328, "uuid": "e982ec2f-83cc-414e-990c-b6c990755c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292328, "uuid": "b166d528-2852-41ac-a16c-08bdd56f5878", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc989d2-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "d933e2da-4fef-4502-98b6-41a174f4f00f", "comment": "Malware payload (Mirai)", "value": "2c7b9f10c3fde6e98a2b04e274bda49d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "6a520849-b65e-4548-b0f2-2c0e42d51b7f", "comment": "Malware payload (Mirai)", "value": "d61cee195f615e4abf35c4f1f53acd3c501279f6bcf126ba20d14cc6c4755637", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "ee940bcb-2591-4956-8345-b7c06455df6b", "comment": "Malware payload (Mirai)", "value": "8f311ed303ef9677a0fb0814098bda2bfd70faa9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292177, "uuid": "fd438c86-fb42-4459-9f15-cc35b16d7f4f", "comment": "Malware payload (Mirai)", "value": "a3b99b7c87fb5322e5f71d2833f1043a3629039991d3cf42db5a2c6764800d5efdd9d7b4e0726e1e18d9b7a6f7af359a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "fe8f3510-77b0-43b9-8442-bc86f5418d71", "value": "T172933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "e58dcb47-739e-4e88-a80e-7dd6e28038a5", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2D2:eyxt7W+G+3QBBntmzg6d7WidD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292177, "uuid": "55cc2383-bed2-4158-813d-3546901548ca", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292177, "uuid": "0de4f794-a985-413d-abad-714173dd508f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292177, "uuid": "4c8696da-88a3-480d-a79b-f60f03b1e39b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd53b7e-5d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780279047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279047, "uuid": "7feb79e3-8395-4d4a-ba75-bb2214f39d7d", "comment": "Malware payload (Mirai)", "value": "688a66c20379d5017030564460a45380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279047, "uuid": "4c2a3177-ccf6-49c5-a3ba-68fc0b7fe1b5", "comment": "Malware payload (Mirai)", "value": "d6bf3019bb9d8c4bf9230104bbcbecd1f271508a8fefe8f0b238ab3da2b7fbc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279047, "uuid": "293b2207-4adc-4e4e-993e-c7c6f939dc57", "comment": "Malware payload (Mirai)", "value": "866b8880bbc88a75570d0595426c4d8628c35b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279047, "uuid": "e8aba609-995c-4cb7-8f2e-25dc2a83c428", "comment": "Malware payload (Mirai)", "value": "04affcf7de1a4a0f3782da81c5ccc7f183b08c1671f05395cddca457699f8d1159ed0694440039c6295afcdaf84fa133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279047, "uuid": "49786bc1-ea85-4ddb-b7cd-b7869ee27f3e", "value": "T130A3810EBFA01EF7EC6BCD3B45E41B05248C651A21A97F75B930D818FA5A50F0AE3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279047, "uuid": "c83744d1-2d40-4090-bc5d-e16014e5e6cb", "value": "1536:VmHc8CWGWQY/9WqyUUgd2lbUBGnBAj0m+Ax+RdZUTb1097W3xgK:V0WWGWQeWqyUUEIbUQn8GdUMggK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780279047, "uuid": "48dc364a-3bb0-4b65-b3f5-6316b9aa1c75", "value": 102540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780279047, "uuid": "843374d6-fb8b-4611-97ff-c3c361804565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279047, "uuid": "58bbbee2-1b92-42b6-8cd1-0b8a8ae11808", "value": "d6bf3019bb9d8c4bf9230104bbcbecd1f271508a8fefe8f0b238ab3da2b7fbc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fecba2-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322385, "uuid": "cc9d76a9-242e-4df0-a6d5-f71833355ba2", "comment": "Malware payload (Mirai)", "value": "7093765e3c465cad6f259b33fd6b3231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322385, "uuid": "7b229892-ac9b-4153-ad8b-7b23af0b7c7b", "comment": "Malware payload (Mirai)", "value": "d81a27bbf882d13e0752fcd8d70a53d67dfdeda877c62fb365e16c4ccae0804b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322385, "uuid": "495ade0a-e5be-4915-90b4-be1050769c25", "comment": "Malware payload (Mirai)", "value": "90299787ce1afced47b8e561a1dfc464df785d5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322385, "uuid": "1b66aeb1-b542-480d-8211-1bce13b0de27", "comment": "Malware payload (Mirai)", "value": "a3fe1706eec07d1fdf65f0b5af5c5c8733a864bfad5686beb7838477e05c767dd61a5c7cdde54a750d15b96465a1245c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322385, "uuid": "771b94f7-bc3d-44c0-96cb-af6b4d06fe2b", "value": "T197B3B409BFA00EBBD8ABCC3709ED1B4228CD655722B93B757534D928B54A24F19D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322385, "uuid": "b222384d-d8e8-45e0-a5c1-0f9e74116f7e", "value": "1536:Fs1M5131VkQLo/+RcGP0Xvw58OL8/e7TZqV7+K5HQfcLT7+KZP:F6MLDkfmRceae7TMaUbZZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322385, "uuid": "4295d45a-3e82-4eb9-b3a8-72ce04fbbc08", "value": 113676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322385, "uuid": "d155c5c8-6173-4f30-8739-3c351c2cba4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322385, "uuid": "fa139e5b-e186-4f4a-baf9-27d903a84431", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b29e6e-5d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780277844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277844, "uuid": "4cb95800-b79f-44b4-a877-4893bc79da0f", "comment": "Malware payload", "value": "f1cfe56a7ec83acfdb4a048d2bc21489", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277844, "uuid": "46f20d88-3b48-422a-90fb-38dbe1e33e8e", "comment": "Malware payload", "value": "d8928fa5bbd91da60a54800884c97cb0636555b9ebba3ff15c11d4312ac0391b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277844, "uuid": "81c94465-4102-4351-b74c-89fe67ed2b3f", "comment": "Malware payload", "value": "4436e421c2a0224fb585a036e82740dbe2f0ada4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277844, "uuid": "12bfb8b1-4554-4ab4-8354-0a5e47fb020d", "comment": "Malware payload", "value": "a6465bb608ea97f734ba6069661dc4ac3fe4f76fc718f7d9a9947248f729d5e983d4ff98f757ddcb528f92c409be10d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "joaobcdev", "colour": "#5728BA", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277844, "uuid": "a7dbbac1-709a-4261-b983-51ae2eee22a0", "value": "T17392FB2577E89B36EAB75F7CE475C12412329B82A402DF191DAC60DF45DAF814021BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277844, "uuid": "80852f31-8f28-428b-be9b-a9bc3b9dba10", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277844, "uuid": "b21cdc71-6039-45a3-916d-61addbd91746", "value": "192:V0jOLvJtwGJDb13LljWQp2p5XL2Iz+iTuyeSd1SQrtHZcVSB9q+acmyv66cfjcRP:65L29wxzJt5cV1yBcLUEZsai+tUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277844, "uuid": "ce54bfe9-8d6b-4146-b69b-3df12ab7aecb", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277844, "uuid": "a33b3da0-e50a-45d9-92b1-f942771d466c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277844, "uuid": "6602ea22-56be-4b62-a6bb-75e90e392806", "value": "d8928fa5bbd91da60a54800884c97cb0636555b9ebba3ff15c11d4312ac0391b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044823f1-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780323189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323189, "uuid": "b35bcfe4-eac2-48ce-8b2f-3419cbbdfaf8", "comment": "Malware payload", "value": "e4aac6cce7fcd1046e6410d4a54148fd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323189, "uuid": "05fdf189-1e50-4b65-ae15-e0d8e55cac40", "comment": "Malware payload", "value": "d8a4361786c81cb9fdf83140bbb1e09500f8bfee9c3193935347ce574a5c71f2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323189, "uuid": "bb7eb3c8-03a2-4326-bae0-819bf21909a4", "comment": "Malware payload", "value": "48b898dae2044e42a9a2c0f63c02a703176edae0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323189, "uuid": "ef8ae721-9308-4cde-abb0-7d2d1992119f", "comment": "Malware payload", "value": "e76fcf99cc273efc696aa1a4f3259459fe40e4a9775f3dc7ef931876e94bd49e609d9ee91f091abe17ed36c05935eeb0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323189, "uuid": "c18fca28-e90d-4c96-aae8-7dc4e9654d01", "value": "T14BF523C36814CDBBD94E9334CAA869BE87671D9CD7E3D1C78B2B3D187BB409C50502A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323189, "uuid": "382bcdf3-c0ab-4038-b631-43dc849ba42d", "value": "98304:7ncABJVtJqbV2o92WR2c3QZuwg8itPbw0Bo:7ncABvmZd92WR2Nw6Gbw0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323189, "uuid": "b4d1f7dd-301e-4884-adb5-67260f15e07c", "value": 3465216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323189, "uuid": "9166798f-1f99-4b5d-a2ed-4112291c7199", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323189, "uuid": "002f1872-be6f-4369-be73-0d4ed875e554", "value": "DocuSign.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f075e4fd-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780293950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293950, "uuid": "dac07835-9ea8-49ee-ba06-307c46754a7c", "comment": "Malware payload (AgentTesla)", "value": "11830efc45ed484332a4ac7eca9ce223", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293950, "uuid": "447e7b2b-4972-48e7-84fc-5e622dffe5af", "comment": "Malware payload (AgentTesla)", "value": "d8f89146217d957acc5444d0dc819116b6906683b01ff189f7d3e3e461d1ade4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293950, "uuid": "e588b8a5-c290-489f-9220-ee561ad243f0", "comment": "Malware payload (AgentTesla)", "value": "95172c34ea0c42318011fced81b8428f6fcf7ead", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293950, "uuid": "9d744320-4c51-460f-ac44-890bdb3aecd0", "comment": "Malware payload (AgentTesla)", "value": "16e97045db8cb7d241d3c0bdac386b61a1ebae273f682552fdee7ec6c08d467a35f386ad8246fe431f4777384c2bb864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293950, "uuid": "59baf0fb-1298-4a19-85d8-d31d5814e31b", "value": "T13C05F63DC814412EF232C91AC99A095FF8E2158B623CE94760D7775BAE63842B7C739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293950, "uuid": "faefe0a2-1dbd-4158-b4b3-c669acbbd942", "value": "3072:yGJORkx4L+Q4CWHYMVAn1D9cH5HeeuHoHS1W40BvgICUsOsY6L1jpfXT0DFVuZ2p:AGx4L+Q4CWHCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293950, "uuid": "5484189f-b156-4d52-bcc4-46ae7c8a0083", "value": 847096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293950, "uuid": "0d1393ac-0058-49d6-b65e-764806bd5f07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293950, "uuid": "b65016a6-054a-4512-a253-d238a531cb02", "value": "PO186-Nature's Own.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c811dc-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322324, "uuid": "a844fcf9-0085-40d6-93ba-d82a207c220f", "comment": "Malware payload (Mirai)", "value": "7e360e45dba3e21fe72f96eb567b1c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322324, "uuid": "6928550c-15c7-4972-9c53-02b28478b4ca", "comment": "Malware payload (Mirai)", "value": "d91e2b5174e6e091201a0b219bb993bb9d8d8603b565663eb626ca285ff840fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322324, "uuid": "53a43621-57cf-4c41-81b9-389bd60bfc28", "comment": "Malware payload (Mirai)", "value": "15a888e5af75d89342332c2662f5b7387ea96f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322324, "uuid": "210fdf08-a483-47ac-ad17-438a256f84f0", "comment": "Malware payload (Mirai)", "value": "7c743365b0ba4b89e055a4c781b4e438e5658d96d1971070558db568c2a2dd30c5a6bfa9c337a7da622f3803390b564f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322324, "uuid": "85a56ad0-e9f5-4480-8326-668cc7d68757", "value": "T124030268C46E2AAEDC1E7DF1EE7489C3B7111BD8BE13C5222B559B11B305D3A7409B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322324, "uuid": "6414f2f8-5b60-48e5-b31e-637b626bb524", "value": "768:NlsvvEFP9qjHLYsac3m/bKvZzobY/qJCWyVN70e6B8EMpMA4uVcqgw09O:PsU9qHLTa/Z9JWUj4V4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322324, "uuid": "33a9286f-abaa-42bd-87da-fe6be3c0ac54", "value": 38508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322324, "uuid": "eedb4e7a-a72e-43ae-8993-b4699b212514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322324, "uuid": "0fd84774-4630-4949-b3bd-13616ee53e21", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39f8f8b-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312423, "uuid": "7bdb0fc1-cbdd-40bd-9830-0aa0777df5fa", "comment": "Malware payload (Mirai)", "value": "30b129ea2249cdf60c0c4ea7606dc02d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312423, "uuid": "7a60f7d3-83be-4327-acb6-50f59b2435e0", "comment": "Malware payload (Mirai)", "value": "d9830b95f5f1207b6c53e6d48aa43a08c6c9e3a48f51156fe8a4caab6042378e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312423, "uuid": "eaf17677-7641-421e-8688-41efaab572de", "comment": "Malware payload (Mirai)", "value": "a6212260854afdad6147424c0e23692229799c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312423, "uuid": "ca104d76-a9a2-4635-8c1b-1f7062ccb218", "comment": "Malware payload (Mirai)", "value": "f4f2efab94dd8c4802f8745769a3a2bbaf4c6af7b286b4e023990acfe834a9db9c4407a245baed0715888707f4d2bb73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312423, "uuid": "e15133af-7067-4266-81ac-d5bbf50dc35c", "value": "T1BFA32996FD818B22C5D512BEFA1E118D331317B8E3DE7212AE205F2077C696B0E7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312423, "uuid": "d8d915f4-ec48-4a71-93d7-67151358db5e", "value": "1536:ZjnuB33/7/fXNNeEGZVXI61Kyrtavaz9Vio0mQHzCM8iJAWnGc17FR5VYYEQs:K33DfLeEMtavaz9MhAWnGc1BR7JEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312423, "uuid": "68dfd9ac-f081-4029-929a-c119f7134f4e", "value": 100860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312423, "uuid": "6d8e1eeb-b4c4-4fb2-882a-e3594d8ac735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312423, "uuid": "fe554f71-ca12-4280-8460-c43bd0f3815e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160557fb-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300026, "uuid": "1b2f6fe6-de7d-404e-94c3-a604f29b3c83", "comment": "Malware payload (ConnectWise)", "value": "d21e6b5d6c6bfd217c6d662d932c61c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300026, "uuid": "5b6fe836-09bf-485d-983f-7311ae4ce512", "comment": "Malware payload (ConnectWise)", "value": "d9d721e95f7e5b51e27627ae1699001e48741e7a52678ceb0669c2fc1157e2e1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300026, "uuid": "fbb0135a-7548-40f1-945a-734d956c970d", "comment": "Malware payload (ConnectWise)", "value": "ff8e3579ef8667961989dc175af6adaa0dd0e210", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300026, "uuid": "8962e41a-1212-4229-ac9d-face5fc45428", "comment": "Malware payload (ConnectWise)", "value": "09ff0ecdd1965c1f36e2e76b413fa627ef55123445f298cb464743bd821d4047dd79f7bb506a00e015a43af1ef7ecb15", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300026, "uuid": "79dcb1e3-71cd-4d11-a395-97cbf7d3be7d", "value": "T1F9646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300026, "uuid": "a1c85f28-5aa5-456a-8d53-b4e69bb24a87", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300026, "uuid": "bc905a57-1fe5-4b8b-88bf-060fa4ce5c91", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9J:h1iw7gryNkSV1hy1Z1u2JLu9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300026, "uuid": "51aa2f1f-0b56-4065-a56e-07f4bbcd1d11", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300026, "uuid": "9890fa27-8058-4b1d-a672-c0a20e692c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300026, "uuid": "5d13d6c3-e0bf-4798-9787-cac0a1536fd6", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c05985-5da9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780311942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311942, "uuid": "0bd59d33-b76b-4b57-80f8-1c0344e6a6af", "comment": "Malware payload (GuLoader)", "value": "ac87db22255b618b546db0abfc120303", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311942, "uuid": "3729f122-ce03-4a38-bdd9-d69e29c879a9", "comment": "Malware payload (GuLoader)", "value": "d9f81bc212ecc590f42afe066311576f23940ab936fb91889a47e5ebf58c8bfb", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311942, "uuid": "89b4990f-98ef-434c-b18b-46ea13c87f37", "comment": "Malware payload (GuLoader)", "value": "e88a75c0ac91862401ac1ab21e1509b8cd084a7d", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311942, "uuid": "83e0c155-ab79-4aa7-8be7-75b4301eb66e", "comment": "Malware payload (GuLoader)", "value": "ac12f9dc61eec87e98e2f52f60d372a1fb62c18cd0b67c8d0c4a95b6699b6a10e53f604f13bbaba422d26f1e67bb6928", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311942, "uuid": "540c4233-c6bf-4761-a709-9ef805269f8f", "value": "T113E312B4FB1AE44882694812492EE39B5460EC03FF6FC6E1298E79D72F11E3195639C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311942, "uuid": "bbca489a-0862-4fe8-a58c-82b00a6d1771", "value": "3072:sC/ifOzZwA5dnPPffX0MHWZpmPwjefqs0qEIKpR+fvhLX4:sC/ifO1wuvfXSmPUmqyEIKyhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311942, "uuid": "f0c5cb33-e772-4471-9f98-59b409a2b46b", "value": 157099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311942, "uuid": "1f19edd4-5f88-4c87-ac84-05b53a53aad3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311942, "uuid": "410e4958-4fa9-47ac-b400-5e7c5ad4ded1", "value": "20260601-001173.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac46e1f5-5d9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780307579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307579, "uuid": "5d0a3ce5-acea-4130-8fee-522c3fdfe297", "comment": "Malware payload", "value": "fc4e024a51421b8b7d067cc64b3694fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307579, "uuid": "99bc1e52-3069-4547-a71c-a7316585f992", "comment": "Malware payload", "value": "da1a3acffea047754f7eab0de4066da8daa39f290bc5268e0baf0575fcf2cae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307579, "uuid": "ef4f1074-ee5f-4da4-86f7-617c0956272b", "comment": "Malware payload", "value": "8b01001f046fbd00a6f69eca730f309597f8d796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780307579, "uuid": "db3566dc-da47-4584-9136-7465333b896c", "comment": "Malware payload", "value": "abb7c5b36ba59ffd8119aea8f95b651d12038f9712df50f2630f20f031eb8bcd65d45720fed7f632efd633bd62afaa69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307579, "uuid": "0cca5c4e-8234-4926-a53e-7fecb64ae67a", "value": "T1B336D747EBB651D1D4BAC0399662A62BFC7134A9C33897DB97814B061B61BF0ED3E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307579, "uuid": "c02d69c7-63fc-4d87-b905-dd4e14a0fa83", "value": "c49f3bb3b19351cee744b2f30bbc8246", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307579, "uuid": "089a2afb-cdcb-4700-986b-615fe88e256b", "value": "24576:TJXBoPE1TjqoZWhMFc5k2EeNziDKBvy99IeT9c9rms0hGaNgL2gHmjDJSyWBH816:TJRoNoZWCCNA1sS7gL2gHmjNOMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780307579, "uuid": "fce84d5c-c821-42dd-9003-7b28bc360d51", "value": 4981248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780307579, "uuid": "3da0f6ae-1185-4eac-a064-02576b93fd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780307579, "uuid": "c48e32e6-abc7-4a71-85a6-196153f1abb4", "value": "ComplianceAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f5b840-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322336, "uuid": "43642ea1-a216-41b4-95ec-ad76b42b75d0", "comment": "Malware payload (Mirai)", "value": "a10e7b79f5e8cb828462eeba8e9a409c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322336, "uuid": "6d2c7974-a078-4053-a5ff-c91ec2ef9340", "comment": "Malware payload (Mirai)", "value": "dac3e58c6f4687e68192fd5d479387687f148eb1f8e3a28bc6bc4023c7714b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322336, "uuid": "9d181510-7532-41d5-b8cb-3f6606d6dd76", "comment": "Malware payload (Mirai)", "value": "d90bca53c35082bf195c808fecd5f63e5b665e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322336, "uuid": "ccc3da1d-cd9e-40ce-9389-bf10a2fa18df", "comment": "Malware payload (Mirai)", "value": "3ab738f84a5c65fd85f9b0db69ce531cab347a0e25f16751e3af1791de79226af91f181b891eaf4b474a99960e1281d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322336, "uuid": "0d08498d-05ee-44c6-bfe4-90eccc109295", "value": "T1A7935C25F979192BC0E4A03721FB4722B6F247CA24A8872F7D710EDDBF615503647AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322336, "uuid": "f39abcc7-aad3-4dbe-876d-32a021aa6dcd", "value": "1536:bfIZWM3rIwJow6jBnmz4Qj8OvxYbIqCgatNnY+5czEw58tbMhB:0M6r9N3vxYbIqCPvnYm6jhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322336, "uuid": "909a6961-d073-4564-b42d-e978fb4ef190", "value": 91464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322336, "uuid": "b57cf55a-02b4-4790-b305-b21a0f789055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322336, "uuid": "0de53a77-a2b2-47b8-8df9-0f9dea397e94", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68a5685-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "f90ae948-67c1-479a-913f-0c0389e8ddf1", "comment": "Malware payload (Mirai)", "value": "91149750c7f13da6326b03f535d0ed2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "e6a71f33-9d80-4ce0-964c-82d0fee8e081", "comment": "Malware payload (Mirai)", "value": "db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "c522865f-f5e9-4587-8326-b9cb650b2220", "comment": "Malware payload (Mirai)", "value": "9c22711d7fc0b2409ad75ec3bbc2baffc0a200d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312401, "uuid": "65d64a49-5c8f-4da7-b552-73700da5d024", "comment": "Malware payload (Mirai)", "value": "28fed1d3815eda52d2fcca874edc4f767a3bdb570a5db1e4ba3fcfbde746500e2456b4c69c49846f217720f303accce8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "a335e920-fb88-47c9-a41e-1d5455b93412", "value": "T16C412EC9327162723C9FDD3263BB4614B0E0B4D261C8DE1698CC38E5D48DE856A9EE76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "cddc4bad-4364-4bc6-bc73-86871a98d8a9", "value": "48:2d3p3ibd/sdLkLY+aLdtdiJdGYBdLYKGdSxSZduCuxd0WdA+dhwdX4dAvk:2dJibmSaLCPBlGEgZchV4igk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312401, "uuid": "60814ee4-a973-4a54-b932-91af21e6ffb3", "value": 2232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312401, "uuid": "c6936f98-c4a2-41e7-b98e-02103a18feaa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312401, "uuid": "5acb7590-680a-480e-aa1e-07ad963760ce", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82756f2d-5de6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780338003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338003, "uuid": "c65afdbe-13b1-46c8-8f99-b23166a3c7c1", "comment": "Malware payload (NanoCore)", "value": "9ee9a2df02714b7e76d36ced99bc84af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338003, "uuid": "3cd4d0ee-f8f3-444e-80fb-8cbbc457f183", "comment": "Malware payload (NanoCore)", "value": "dbe50aad918d3d19f06f0b3dabd11791180258c761a8655f1f3dfc68123a991d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338003, "uuid": "140204ba-7059-404f-b00f-0cbfcb44689a", "comment": "Malware payload (NanoCore)", "value": "7ce82e6a3a15090d9baacd3fd5c9dcbeebe0d12e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780338003, "uuid": "bae14fd7-3352-4ab3-98ad-f8518647afed", "comment": "Malware payload (NanoCore)", "value": "35bb2ae76ebc40031cc6839c96766e550191cc1a1253c91690532ba869ffaf44a71993e5a0feb16e6945c5e631df72fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338003, "uuid": "1eb31b94-daf3-4f7f-8ebe-0b7a19951717", "value": "T18114C0163BA84A2FE2DF86B9711216178379C2E398C3F3DE28D451B35B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338003, "uuid": "b92be83e-744b-4943-a751-cb4772d47dcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338003, "uuid": "6d16a7ea-72b2-4bbb-8ae9-9cf75b44fe27", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI3BXzMrrC/Y6jmdzBb6KaGaOCp:MLV6Bta6dtJmakIM5+kC/nqzp6jGaOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780338003, "uuid": "c53b0217-16ce-4c84-8c58-cbb97a79acaf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780338003, "uuid": "7345d59a-59dc-43a0-b085-bb561e017260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780338003, "uuid": "09893239-57d9-4291-8cb0-d45a741630cd", "value": "sam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4cd65e-5d57-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780276684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276684, "uuid": "c973973c-27ec-4eb9-a1b6-be9e1af91798", "comment": "Malware payload (Mirai)", "value": "c4c62efb6e55aeeef19639eb931a812e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276684, "uuid": "9956a034-4cd5-4d35-9b05-318ee1824aea", "comment": "Malware payload (Mirai)", "value": "dc0a53205358b2bda54f7b9e26364fb5c81f6353d1f0021de4db237cc5748147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276684, "uuid": "5f9b2f5b-abce-4885-af45-b924007349af", "comment": "Malware payload (Mirai)", "value": "4310d46d392e21df969ee7bb827e08c86b171a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780276684, "uuid": "614ffff2-38f2-43e3-ab0f-2767a85d5a16", "comment": "Malware payload (Mirai)", "value": "022a306f2126b08829117248c71b51fc3e2ede24b028dff18bf8faded357cd0373365835459d7a3512c377946eec85ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276684, "uuid": "679cb416-85bd-48c1-b786-298c9a91d78e", "value": "T1BE663947EC6525E9C0AE95308A639113BF717C494F3163D32B60F2293F76BE06AB9394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276684, "uuid": "968fc0b4-8c5b-4882-9b02-67e53cbec5a0", "value": "49152:93Ks03b5ysgHlr2JsaScRz8YU8NpMSH9LHgDw1wq5BiwxYGpON0NxzVM3KlK1KVZ:93K3FCYHiIA6wuD+bEQwEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780276684, "uuid": "7b131375-2c42-4b4f-ad47-0bf64f45ba1f", "value": 6832290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780276684, "uuid": "4ddd96dc-6548-4ff0-a184-ecd237431d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780276684, "uuid": "fe0ab6e0-4288-4928-8b2e-dbc72582bd9a", "value": "dc0a53205358b2bda54f7b9e26364fb5c81f6353d1f0021de4db237cc5748147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295ce5e1-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278154, "uuid": "a2475aa0-ffc3-437a-83bf-35c857e68480", "comment": "Malware payload (Mirai)", "value": "db67fefcc4d824cc594f2247075ecae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278154, "uuid": "e4119e83-84fe-475b-ade7-fc6be46f57ca", "comment": "Malware payload (Mirai)", "value": "dcee277c1b82b63bc6df7dce033b691da1f60e3292ec6c5357d01d0c926884f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278154, "uuid": "1013ab45-478f-4a30-90d5-44473a474a12", "comment": "Malware payload (Mirai)", "value": "cd90cb2d7cdb156e625dbeab59373c272a62489b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278154, "uuid": "05886057-9b99-4fd7-b8e2-a0cde0ce610b", "comment": "Malware payload (Mirai)", "value": "946209ad30dc857bcb06dea94bc408f8e695f5c0490175a0a9b96e49a4ee6d601cd2bca0dee6e36d975a6188894bd5ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278154, "uuid": "45665342-b28b-4404-b5eb-dc48dd34345a", "value": "T19AE39248EE64AB2DC3E332FEFB5902CE336A1BD8B7E670218D354A5537C8B55A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278154, "uuid": "27e32653-8c10-47a7-a92a-d66b81546434", "value": "3072:87TVt9dEYVQUNuEuJ2qVqyD7NkETjtMfI7mohM5BiN9SXfS3:w2kKicmohM5BiHSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278154, "uuid": "85ca14a7-b875-445d-8b6d-99984677c230", "value": 144540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278154, "uuid": "4a4f58e7-3633-478b-860d-12f7434d0855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278154, "uuid": "597e8117-bd51-4b87-b694-7c8dcf772b23", "value": "dcee277c1b82b63bc6df7dce033b691da1f60e3292ec6c5357d01d0c926884f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad602fc-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "bc3b163c-fd30-4ad5-9dbf-3baf27460ca0", "comment": "Malware payload (Mirai)", "value": "c34b4f5e471b56a4de27894444b00ec2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "41276afa-e2c6-45a8-a5dd-5e4ba70f375d", "comment": "Malware payload (Mirai)", "value": "dd4199c2b8d94da33925badf03a25a5a896c71167a1afa6b8fe6119a4d28f213", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "69ad25bf-273f-4bd1-ad70-66d769bfbd1b", "comment": "Malware payload (Mirai)", "value": "2af3e4d8a2e7f61b5b5afb550fb9ebfe80da1c14", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292330, "uuid": "077cfe20-f97e-440c-a053-85e044e9de70", "comment": "Malware payload (Mirai)", "value": "6ac282e9235184f8e36363e06ef6fdafb955687ea5270bad4294f4b5814fb7d2061780aa0cbddf51b784d0742fd21548", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "58822164-d7fc-4b0c-8d53-b7a952a555a7", "value": "T1F003F28F0FF47E89C6995DBD419F02A24D9C73D2B3690398EA0454DC2AB4C5BF056C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "def96827-0f9b-4268-b290-abce890d1031", "value": "768:hifVq1zOXtSnXXFjD41UAdTlbU5wcSA/bT7H+VOp/jGL0Xq1W970:MvdSnl2/dFUGc9D38w/E0a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292330, "uuid": "a4a327df-677e-4ea4-a19c-be7e8b28e11e", "value": 40128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292330, "uuid": "69e5f944-0710-4119-b4d9-1e4a5ca3b988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292330, "uuid": "d9e27271-1f89-42a7-a1ad-1a4a94f9b52b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc53c03-5dc9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780325647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325647, "uuid": "17c718a5-794e-43e9-b7e9-7da0c5ee0ce8", "comment": "Malware payload (GuLoader)", "value": "664cdb7f652f865793113d61421217c9", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325647, "uuid": "ca53f19c-7939-481c-9bce-7a03f9249764", "comment": "Malware payload (GuLoader)", "value": "dd70f6f9b5276fdb2e2c79d6650e993c7dd08fc34a3529ddfb10744dabd645e8", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325647, "uuid": "b95d1fe6-5b67-4654-961f-ff6737aec6f7", "comment": "Malware payload (GuLoader)", "value": "9e0b60c8cc4b596201ef662740cec1e430c4b3ca", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780325647, "uuid": "3360b4d8-3259-4836-b433-50d210fc8a25", "comment": "Malware payload (GuLoader)", "value": "16e75ad2daf8e595b93096ef82863a475302ca11cefc97a4a4f3e1f74d98d14fa3ba6fb23545e9837eac6532e7855162", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325647, "uuid": "bb1d2afa-64cf-46bd-9295-6f03cbe3e19e", "value": "T1E7645D20ED24067A0F47179DFDA60B61CABDC609862754F5F6DA070EA0065ECE3BE36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325647, "uuid": "903f3fe2-d52f-4159-8303-649d45a04a25", "value": "6144:XSiBvpgmWYWMvYoQimegCDJaDytfKrv5O5DQ7h0pqpPMCH7PTR4WQBbe6V:5pgmr7tUe9y854z7rR4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780325647, "uuid": "1e39a528-cdbc-4301-a8dd-a7a9a0d595b4", "value": 324753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780325647, "uuid": "fb264ac8-b20e-47f9-93bd-2fb5198c0aa7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780325647, "uuid": "23560b97-a7bc-41e4-9ddc-b70449940788", "value": "IMG - stampa il campione di pagamento di 2 pagine in 1 A4..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cd2063-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "df091f59-ef6d-43a8-9e24-2516fbb2eba5", "comment": "Malware payload (ConnectWise)", "value": "bdc26bd9198932e20194d19e820c429a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "641c4c9e-2d4e-499f-8fdf-74da242eee86", "comment": "Malware payload (ConnectWise)", "value": "dd7496fabd96645126996d8be44fbac5d1b6adbadcc2220eb98c0d5cb461ab46", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "23553a2b-9db5-4b6d-9335-84809c426294", "comment": "Malware payload (ConnectWise)", "value": "7739d918a16a4b33469534a826d9da56bb7e3275", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297688, "uuid": "3fddf5ab-7644-4d5b-8342-9f36da1c815b", "comment": "Malware payload (ConnectWise)", "value": "dcc20700fc983eb617040c888b9cffad66d3753dd11eda56b513022e5d843418833071f77a74eea9bb34634962ee02c0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "30ee20c4-df9c-4b1c-9f2c-e5adedf87321", "value": "T1A346E111B3D695B6D1BF0638D87A52A96774BC048316CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "7841f994-08eb-4b97-ba2b-1af2d8adb1f3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "51025e82-bf27-4b84-ba5e-e51ec944245d", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297688, "uuid": "9a2ad1d0-0966-4681-9619-c2d95ccbf794", "value": 5693472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297688, "uuid": "c1047c11-2ae0-4e5c-a5d8-21ccfc2acdd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297688, "uuid": "dc853967-d4a2-4fbf-84da-512cc4541256", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d90e0eb-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "7b7b3040-3678-4f19-983c-1df64acf4efc", "comment": "Malware payload (Mirai)", "value": "d33222bbd501118815f55d80a8e251f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "5a21d73d-5bb6-40fe-9b0e-00ef15227f8b", "comment": "Malware payload (Mirai)", "value": "de3272243ad9ae5b9e37324de70ad7296b4c5e46b6d415eff8ba8b2c42060276", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "a5c86f98-6f7d-421a-be59-3623e1dd341d", "comment": "Malware payload (Mirai)", "value": "1d78162b64b753f0d8d9278176fb9527544933a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "47d139dd-70b7-47ee-8783-a1ae6f6a9ccb", "comment": "Malware payload (Mirai)", "value": "8d419500487abd230d21e8bc03e548f4e833e061caf0d065d639376e1aa2c04b359da33a1569dd86e56aad6cdff1e952", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "b844be84-417d-4fb3-ab09-baaa67f00fbd", "value": "T134D306D7F900DAF6F80EE3374853080A7130BBA249925A377257356BED7E1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "30f22d02-e429-4e50-a1bc-1418f562a0d8", "value": "3072:CtEDiETOYArLanPwtgpyrLzMRi7ahs/581HoKVTjbifLv8qoq5O:C3ETOYArLA9pyrHMRKaA+HoxLv88O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292898, "uuid": "bb67b875-e494-4ae6-9488-e792eebe6b76", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292898, "uuid": "c2321ba9-3924-4254-928d-61ee080d98ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "e93aafc6-cb41-4354-a916-08ff296f73ab", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c051f4d-5da9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780311605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311605, "uuid": "aa37736f-9d53-4486-9e16-09e3f1c40142", "comment": "Malware payload", "value": "78b316215985631f7611afc473228c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311605, "uuid": "3ee6910e-fa96-476b-9c57-66d1a2838e3b", "comment": "Malware payload", "value": "de65ce687b091c84efac8f1e46502b489c1e187e84aa8f8d2bd63ef94e3666bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311605, "uuid": "4e0cab54-6310-4387-a308-dee8282114b2", "comment": "Malware payload", "value": "9f754381eb9158400d70270117beb77e15ab6b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780311605, "uuid": "77f770f6-255c-439a-b450-77d7911d3b57", "comment": "Malware payload", "value": "11d9985799cd560d2303d88ffe9040c4d88ffd412ae7deee6dae33b76c0639e765fc131edf2c9cb50d2568c6e84dc62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311605, "uuid": "ebff87ec-23e5-436a-8a48-656a74457eed", "value": "T185C1724157F88226E1F74F34ACB743162A74FA111A73DB4D1CA8122FAC72A018E62BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311605, "uuid": "2d848a4b-fdbd-4ceb-9e9e-e8848517b822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311605, "uuid": "39ac7986-f455-44ab-8391-fb8004bf4512", "value": "48:6o6EtgBYKgyBSistLBxd0Js9ZBIoYlKo7jhIB/eyZlm9BtntwtbZSAWsPEBHdClb:xLcki0bcn790jZlm9RwtZF8BU7LEA0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780311605, "uuid": "5c8cda42-d729-412f-a0c8-9028a059e645", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780311605, "uuid": "452dec02-2f5c-4850-9f91-91653e0f9213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780311605, "uuid": "70f36ab8-0b51-4ab8-be32-a1603c564a85", "value": "rremessa-3w98uh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0ba5c6-5db9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780318474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318474, "uuid": "dbed3b3d-98a6-42c9-a259-ab6f440c54c5", "comment": "Malware payload", "value": "090d7d54b87e83bb22af06ea9f2aa410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318474, "uuid": "a6f34bbf-5831-4846-abe1-08b9179a41d8", "comment": "Malware payload", "value": "dee47219a890900261c89dc51db234be9213568a8c0a89290ac155adf7b79c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318474, "uuid": "8e83e4c9-f49b-4e4f-8764-0ce7f6721469", "comment": "Malware payload", "value": "56a7203e6310fc37f6ebeb4573f9cab91b40f45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318474, "uuid": "43cfe440-8413-4549-89f1-6e634ab7a5cc", "comment": "Malware payload", "value": "674ff1a4a5e233c03021b31c53f88d0be226888edf3522ea52409623fa284397c54f8deb12f74225dec69255fc9834a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318474, "uuid": "ce528e3d-2ace-44c5-9200-4354ce7797c0", "value": "T14B262A16FC9654E6C1BEE1308691A362BA717CA5833137E32FD0AA7A1A35FD46D3D304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318474, "uuid": "a97b80c8-b8ef-4783-bcb3-71324e552c34", "value": "49152:8vgK+Mb3oE+hY8R7UWwLbitfCUOoNirQ0CY8kpDqJV1:jHMb36j7U7StfCUOoII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318474, "uuid": "2c802c62-025a-4ea9-ae1f-359621f149cd", "value": 4726784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318474, "uuid": "20be1f7e-b27b-41e9-9fa6-8038660bb1da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318474, "uuid": "26e3a16e-d04d-4c81-a236-3991cce3453e", "value": "check", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e54205-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "fccdb86a-8a28-41fd-a367-71c131be1b2d", "comment": "Malware payload (Mirai)", "value": "e9caba81e8d513b96fe13733ef774d8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "d87d833f-e4af-42cc-bb6e-2a4aeef9d8aa", "comment": "Malware payload (Mirai)", "value": "df5a544637ca04758ce210cff2943aec8406cca4fa31efe9cf8820b212836974", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "e95a7131-08f7-4e51-8c89-fc1f36d4cfef", "comment": "Malware payload (Mirai)", "value": "ad12f597d9b835097402395ba49fec43301ac9ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "e6e49f79-64e1-49e4-8e45-885a9e5f1106", "comment": "Malware payload (Mirai)", "value": "133696cb18cce8226685c33456051085782a34e2e594bfe0dde65b7fb0690e25b7628eaa0f6d894d9d2abefb7d6da1ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "b830a3f5-bb90-4614-ba0c-591bac8b91a6", "value": "T10113F112C21806F6C6A728704CA3E89337EA4BE87DB795DFF489BB63CD65426C3495D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "d4411092-cbbe-4c2c-902b-0df034dd44a5", "value": "768:22JCFCB4J4GnDRF/K0ohgxEAWZD+PZyTIyB2S+fv9SaP04uVcqgw09A:2234WkP9ouEFZD+6B2SVac4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312400, "uuid": "f3a809f5-1463-42f5-b7eb-1d3b56bd6641", "value": 42176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312400, "uuid": "ea3c42cb-e9a5-4ae4-a745-d0a0d0a6f1af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "edcf1226-5cf0-40c6-a596-042903841d5b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56c9812-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "249a6cdc-c8db-4023-b666-be596736c3f6", "comment": "Malware payload (Mirai)", "value": "92d15bc1d4130267a0fcff39d01fbfed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "5239cba3-bf63-412e-bf35-23e39a84f751", "comment": "Malware payload (Mirai)", "value": "dfd542f72cad80cd5536ec3ce826c569a64f0c5ae2f5451f6dc4a4fda9746de8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "cb627e6f-3a21-432c-91bd-cab19c1ce1aa", "comment": "Malware payload (Mirai)", "value": "75a26c1c027fef8ed20c80c5afcc9cf88c5f0e71", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "37bdab37-2def-4092-9729-40879dffd3b3", "comment": "Malware payload (Mirai)", "value": "e9f86070f7157eeaa3d41df94a469be502ff22ed16d3dc0905d36627bbd8538f4417c370a0501af6d66571281f860583", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "9468ed47-8423-4bd1-8f18-757ed888a949", "value": "T1E8A33AE6F801CE7EF84ED77B44530A0AB535A3E106831B376397B963ED721955823E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "569c443a-5b02-48ac-a8bb-e85f6895f2d8", "value": "3072:uvAIKq6yY48jBNVwy7y/PjnaGA0KC9XsqY09Xyl:tq6yywy7aPjnbX9e09Xyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312400, "uuid": "88e40be8-7736-4fe6-abe5-7396ad8b50b3", "value": 100840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312400, "uuid": "296aef25-fa41-49da-b2d1-444cc66646fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "ee65ca92-ecda-42f7-abb7-00f432a84257", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dde0883-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "e0754c93-f7dd-4d6f-b96d-284603e52803", "comment": "Malware payload (Mirai)", "value": "7c7869269a34e07910f7108c7918ff20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "03aaf7cf-6ba1-4226-a640-e6f0b01912f6", "comment": "Malware payload (Mirai)", "value": "e019a3a33192450ef27162103599c89da0cdfa64025bd735634bb412a985b745", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "7101a93e-909e-44dd-9177-1832be7d90b8", "comment": "Malware payload (Mirai)", "value": "fecf65868590a6317439b184129039fd8698bf69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292898, "uuid": "953fde9f-fa82-47e5-a7dd-45f6aa049607", "comment": "Malware payload (Mirai)", "value": "735d9e36e52d8805dda76aee85d1260b9453c9cd612679f508e51f30c70a35a9c9ad23ebc61953acd8cbfb750920ac6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "2a5ff9b5-16b8-4063-845f-611a6d9e366d", "value": "T17CA3F866FA15EB3FC40E933068B3C75056D12DB22EA15A7E3364EB9C2E3015B1E5B5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "6a87cfe0-827c-4301-844c-00f9e3f90b0f", "value": "1536:iHrqTl4dW7QDns4oh938ZQS1GWqpY/mJhq/wa00ZBJjCBCtO:iLqTl4o7esfhl8qS1GXpY/mJhhAvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292898, "uuid": "b1dd052a-193f-406e-be6a-de217738e31c", "value": 100776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292898, "uuid": "a66b42b0-df3b-43a1-b454-7f9093fc9145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292898, "uuid": "46923e77-f65f-4e33-a671-6f76017f2fab", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff35fe7-5e08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780352736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780352736, "uuid": "ac4e431c-826a-419b-beb7-9c9e060537a2", "comment": "Malware payload", "value": "c5055d7767871897e2e96235e9448738", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780352736, "uuid": "2e036ea5-6b08-44ab-838f-0073d5e80302", "comment": "Malware payload", "value": "e19eed96a246d7a5f33796446931ae643afeb153d7a243e3b9d11fbd1e6d4a48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780352736, "uuid": "e9e006b1-51bb-4e6f-b5b1-7284e3c56a05", "comment": "Malware payload", "value": "94982027eddfeb78442a57de130ec98057c15be8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780352736, "uuid": "0960a4b3-a042-43d9-8853-bc2fc6a1e96d", "comment": "Malware payload", "value": "3aa40ca37b2dd4d824b5a1c41398203a94aa5cf1cdb6326d447682aa0797bae1245122d39ba9a6ce12df155cf5691d76", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780352736, "uuid": "b5abf67b-5f61-402f-8f66-bbe5f86a47d0", "value": "T1EC0159CD80079B1041C9E49D32975184B81483CB26A18FE5BEAD547E8BA96487026F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780352736, "uuid": "300e7dad-144a-49bd-a74e-c8596ba55d2b", "value": "24:kXCKysE2hi0ziQvZohaDh6wnn8hT4dBF86X:e9Qp+MsDh6086Bq6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780352736, "uuid": "0ce723ed-0597-4c29-964f-34028351cf4d", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780352736, "uuid": "09f27949-3cf4-4cdc-814a-2439fc0cc6b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780352736, "uuid": "9fd3e17a-7924-4528-963d-38231c40adc6", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8e4435-5d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300552, "uuid": "29eb054a-6989-48a4-855c-dad5ab7cf064", "comment": "Malware payload (ConnectWise)", "value": "7911228b1bfaae28d164f2558c5344cd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300552, "uuid": "de97ccfe-505c-4f72-a6ca-cb49fb605cca", "comment": "Malware payload (ConnectWise)", "value": "e1c5b305fff7516f94bc2173caff4d0168df91e131488ac066bf3c340ca46c27", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300552, "uuid": "b5073387-c164-4bba-ae54-bf20b7b726c6", "comment": "Malware payload (ConnectWise)", "value": "4e66cc5eb080e1a2ae66e9bb7345c7b9ca440969", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300552, "uuid": "d7a5e42f-a9db-4a3a-a1f8-837545a1d15c", "comment": "Malware payload (ConnectWise)", "value": "28d481e295350e36a5c1f2440ec585bf0f8ca8a1488ae78c472e1b977872b1a51e3dd2072f95e924fbef79c7f986ca0d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300552, "uuid": "dcebac7d-2bf0-4586-9b79-3f930c87714f", "value": "T1F5646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300552, "uuid": "cf98c024-4f1f-464a-8f77-9ad6e896b2f5", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300552, "uuid": "63c5f0ee-7be4-4621-b264-58b03b8ed7c8", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300552, "uuid": "06319124-6229-48b5-b1f6-118523f2f8b3", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300552, "uuid": "4c76d67e-5fe8-4edf-9ba6-9bbb52792ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300552, "uuid": "744bded9-b2f5-43c8-8783-33e0c5a71301", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fca4b9-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "73651697-c8b6-46e7-ba5a-43d31feea3f7", "comment": "Malware payload (Mirai)", "value": "dcced85cca6d341b85487b7839c211ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "aa9e8d4e-613f-453f-9853-b461751c7042", "comment": "Malware payload (Mirai)", "value": "e2093d7d177396fb32ee0ebdd2074fcb778295c9fdfaba913dbcdce5a7c14e55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "009272a4-80cd-495c-bfc5-516a9badfd85", "comment": "Malware payload (Mirai)", "value": "3843d87ee909118532003e0b14e4f8537569e959", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "255d75b5-4227-4612-9bf9-a08482eceb04", "comment": "Malware payload (Mirai)", "value": "44f27dc96c017e4de6885937fbc8bde960216f58147d5fbcbda13ce5ab5aab04f27ac3e034b907b9945cd0c05f34e9e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "e7c81ac4-fd9b-41b9-a8c0-b8b648b518dc", "value": "T1F4A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "982fae35-68d9-4ee5-988b-4185777f23c7", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qkla:ip3PSVWxHcqRhzhNPt8Qkla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292179, "uuid": "14132560-3db7-4363-b893-10b395bf1f9c", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292179, "uuid": "efff2a64-93a8-49d4-8cf7-89f592aab2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "5e8ffaa5-f534-46a1-be5e-de7db76892f3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c3a08c-5d88-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780297614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297614, "uuid": "3900cbca-58cf-4b3e-998e-0ffb2a3e9a7c", "comment": "Malware payload (ConnectWise)", "value": "4017f08bdd28f1c16b93d2c587c9bf5b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297614, "uuid": "de5c9c2c-f010-424d-80fa-72d358330323", "comment": "Malware payload (ConnectWise)", "value": "e23ff3aa7eec990c1559d18a2631b1a57475e83a86a59fb80cf45349d64b34f1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297614, "uuid": "6558713b-1e18-419c-a965-a79e485b45b0", "comment": "Malware payload (ConnectWise)", "value": "b2a9e298b8e4d1bd63e06c8faf7522737ceb8b3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780297614, "uuid": "62432176-9b37-452b-83e9-11e6034acdbb", "comment": "Malware payload (ConnectWise)", "value": "5159e4febddf401431f506778e41c0a3fc49c1fcdc43804ca1b3592de4d47db398c785107c3e6791a699c0a109c6356d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297614, "uuid": "0b33b4b0-1e47-4962-919a-632e8ce12781", "value": "T1B2647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297614, "uuid": "e9eaffbc-397c-44ce-bb8e-0066af9c146c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297614, "uuid": "173f5972-a68f-4d1b-83b5-0d07247e8e8a", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:Q1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780297614, "uuid": "106d3960-329d-465f-a5b7-71380f4a408e", "value": 312592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780297614, "uuid": "849eacb7-6963-451f-a981-93866c0c6094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780297614, "uuid": "c6e73f34-454d-430e-b622-7f52c4a437a4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c060d7af-5d59-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780277548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277548, "uuid": "1df85cc2-fad5-41e1-b361-62972bb19ee1", "comment": "Malware payload (Mirai)", "value": "9184baa4e25520011543f38ef9701878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277548, "uuid": "78fff2e4-1231-45b0-b402-494d633af649", "comment": "Malware payload (Mirai)", "value": "e27a3a5a4c65732e788b025cc2566ebae655359408eda61ff1ce6f4d6a823441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277548, "uuid": "e7811ac8-7104-40a5-b65c-1a6890a0bec7", "comment": "Malware payload (Mirai)", "value": "543952f015523bcc7c08971e41d8ddd75623357e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780277548, "uuid": "44199222-a9a4-4a24-879a-4456f3c35b18", "comment": "Malware payload (Mirai)", "value": "2e485419494e235c0e8bf229d47bf6bd722e9d6958bcd5dada8487dd4dd918dcf58e0b0a139ad91cf3e443fdc3d7982b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277548, "uuid": "99650f7e-5d87-44f3-a65f-ebb5978987c2", "value": "T149A68C47EC6569A5C1EE923089B391127B717C490F2163D32B60F2393F77BE46AB9390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277548, "uuid": "47b985fc-577f-4d25-822a-f0c46b0d5177", "value": "98304:83K3FCYHiIP6wmD+DEQlEduDtSz/a583aYiMwRZOn1ts42:8qAn1KD+duJS7kpPy/s42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780277548, "uuid": "07a7270b-d461-4308-a39c-41809d443cb6", "value": 9860557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780277548, "uuid": "217f906c-bc47-46a9-b8d0-d3680c725f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780277548, "uuid": "bf3e6b69-1be1-4d86-be3e-b3c3e3af8ab4", "value": "e27a3a5a4c65732e788b025cc2566ebae655359408eda61ff1ce6f4d6a823441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fba4316-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278164, "uuid": "333a113d-47ff-4d1d-930d-9bb8b678a5f0", "comment": "Malware payload (Mirai)", "value": "e1f0915042b661f0440aa1f5cf9852b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278164, "uuid": "2f885a12-288b-40f3-b11e-08a78cd21a92", "comment": "Malware payload (Mirai)", "value": "e2ffd78b3a881c9f431adb6c63fe359c4d059594d0f10562fef41af7e0bccb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278164, "uuid": "d263cd98-62d5-40f0-bd3f-78d9ad58af02", "comment": "Malware payload (Mirai)", "value": "6f6a461147d40221e3edd7dbc1e698b8d3f780ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278164, "uuid": "f11252cc-c955-48c8-af7d-8dcc4c2fb9ef", "comment": "Malware payload (Mirai)", "value": "b5d99df2d16818da479dd4c2f8dcb88a216181929008f609cee0eef2c54f23b2140c75bf57874d8178b7579a276ef866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278164, "uuid": "a09d09d5-cbe7-44ea-90c2-2d74ede8818a", "value": "T15363194262280943C6F21EB0393B17E1D3EAEB9312F4B349360FA759D1B1D37A946D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278164, "uuid": "652c5bf9-25d9-4924-8fb0-236f9d2a0cc0", "value": "768:tCMvC8SvX/HzL0j7wn6Xz4OZrdD9Fwe89dkLRKiwzyII2fOJTUNW4WzWx6+bT03G:tCUaiy6BZFvKkEiaI2WJTYWzWVw3KveK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278164, "uuid": "c03eadca-4fe3-47dc-95f7-ed3df3c9bd95", "value": 67820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278164, "uuid": "519eafdb-c902-42e2-a2b1-027e4655abad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278164, "uuid": "750a9d56-7bf6-4ff6-9e3b-f9e161979268", "value": "e2ffd78b3a881c9f431adb6c63fe359c4d059594d0f10562fef41af7e0bccb7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf48202-5de5-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780337563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780337563, "uuid": "1867eec6-d4e3-4802-8bd8-046f469ee4ab", "comment": "Malware payload (ACRStealer)", "value": "40279ce4de656aada27374a03062264c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780337563, "uuid": "e3bfe164-c202-46e4-849d-e37c089809f1", "comment": "Malware payload (ACRStealer)", "value": "e30a11906aadffc1682a1b07934301c6b68b854c9979bc64fd65152a349ed59f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780337563, "uuid": "08799ef5-179f-46c8-b9fe-2b78a23f2175", "comment": "Malware payload (ACRStealer)", "value": "5cd43e2378ed0d065ea1187f55645d99f3cea884", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780337563, "uuid": "4d45bb46-d1ea-4f0e-ad59-af0b266d46ab", "comment": "Malware payload (ACRStealer)", "value": "530c9cbbbd57fd3946030da0da1c2e55ac1387fa333311a8b2f68dc1031b690f353825ea14cb748f54d750c3455432a5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780337563, "uuid": "2d434212-88cc-466a-b071-be2f46b0d29d", "value": "T1C1D6ACF27CEB1966CB8C25FD640C66429CEF5F3E35B1A0EA5E1741BD44224E90BBC14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780337563, "uuid": "5b5ee7e4-66e7-4ca0-88f0-0dcebe93e24a", "value": "89cbd0d03f658f7b76d6cfbf08bc6fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780337563, "uuid": "fdae4839-ae4b-44f8-8fdc-2f94cec35030", "value": "196608:24dAU0UgnZKQw/+CchpKZVLS22/HbcJOUcDaJ/uAB1Pj0NPvDqrv2yyj3lxrpeZ:24WXKJchpK4zRCJPB5jGcTyjlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780337563, "uuid": "f322483a-e535-49d9-976b-1403a52849ac", "value": 12670976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780337563, "uuid": "d59f46bc-bdd0-4128-bfb2-5d05d2505d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780337563, "uuid": "de2b772a-12ee-4431-bff5-94ddb55b9799", "value": "cf.ch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cca11e-5db8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780318411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318411, "uuid": "8344f9a2-f0e7-4def-a58f-6f4027edf4b7", "comment": "Malware payload", "value": "546b60c08047ba191fd99b4d509bd61f", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318411, "uuid": "857d58ea-113f-42a9-9f6a-11e5450396bd", "comment": "Malware payload", "value": "e47dd0230c2fb8b585744b476956cfe15adeefbf4069be339dfed8bc0721f699", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318411, "uuid": "6ddad52e-1ac4-4973-94e1-790c72069266", "comment": "Malware payload", "value": "ef1f59f7f1adca458a54ecd0f78d5162bbacaf85", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780318411, "uuid": "7e7a03e6-c7ed-4a09-9deb-cd927253c57a", "comment": "Malware payload", "value": "1cca88b4723e817216c6fdebdc5a3010bbac08c3b223d55b309cc1e340a80a581f5c21fb3232ffcd8e04a7c52001be8b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318411, "uuid": "f9dfe88f-dbea-4bca-8ef4-c47af2ae78f0", "value": "T1C1653321838B7099E45EEAF45766F248DCD7D6729F2E84500C033FB82B5AFD789B5490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318411, "uuid": "d89b933f-6bec-4e3f-8cb8-009627f6136e", "value": "24576:2Y07IqWwo6yLkDA7P0Ey7nMtQLMxxeAb2RNJINi6yyhDu:2BtW/RLkDA7PqMqLE69TSDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780318411, "uuid": "dfa7f052-ded1-45bb-8b98-c4b412428d1d", "value": 1423136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780318411, "uuid": "26507b19-23b3-4a2b-b804-608c2f760846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780318411, "uuid": "9f010387-704a-45ac-b45a-1dfc3ccda93a", "value": "get", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c28df-5d4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780272458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272458, "uuid": "dde94e78-be0c-4d3e-a33d-fa6295399947", "comment": "Malware payload (Prometei)", "value": "ee4c71c272485e6f023d826906595b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272458, "uuid": "7d363ab0-6b34-43f2-a660-95b7b1ae8e49", "comment": "Malware payload (Prometei)", "value": "e4ce6007899a4e82918d396c51dce60f783c15e95bbf0dabac5fe78a134639bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272458, "uuid": "d816c52b-2528-4bc3-9451-3282e67927f1", "comment": "Malware payload (Prometei)", "value": "d12bd249fa482e8eab2d6c19d635ff2b1c416827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780272458, "uuid": "a75ffe45-85ab-4d93-80e0-b29460a52aa1", "comment": "Malware payload (Prometei)", "value": "f20770639f2b669d099207198184e04a97863091a5e5f297cee06689e170e2c7d8d9ecd138150dcd03dd584174e9e64d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272458, "uuid": "89a7dacb-1409-458d-9c6b-1c6767e08397", "value": "T1FFA423B4F9229E9F6DD769B91B24C31DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272458, "uuid": "443db09b-b0fc-434a-b78f-cb0382be5696", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdC:Fs6pyCC/Ya2hpi6T6N4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780272458, "uuid": "08289f02-f706-42c4-a0e7-b5a7dae4162b", "value": 449052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780272458, "uuid": "e5d51ef2-7098-43e6-be77-263dd3381d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780272458, "uuid": "3ac5177f-e6c9-480a-ac29-fc184c3abbd4", "value": "e4ce6007899a4e82918d396c51dce60f783c15e95bbf0dabac5fe78a134639bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b691c19-5d5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780278157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278157, "uuid": "1e00b5dc-bf40-44a6-b3ed-c1faf58373cb", "comment": "Malware payload (Mirai)", "value": "69302d34b8270a209ab782260eca5fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278157, "uuid": "cf68c756-c635-4ce1-a0c4-95c4cd94cede", "comment": "Malware payload (Mirai)", "value": "e54725fe55372f7f6c5459aba1fd5d4952a30a70c6f44c39f8428671931ec13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278157, "uuid": "13626c77-0165-4934-b95c-0ef512affb24", "comment": "Malware payload (Mirai)", "value": "d63a310d433f4c731778b671c45fd564676c1d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780278157, "uuid": "27c05ec5-1410-4153-a82d-6d27f54f1fac", "comment": "Malware payload (Mirai)", "value": "de419dd2371a01a4f980c3935ab3d7a4bd09a0a18ebef63e22c5d96695c3df1eb1297ed1c1d2012694aeff911d2cb379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278157, "uuid": "6ae0a5b4-0beb-414d-a636-b0ec2d43d447", "value": "T13463290368A081FCC155C570AF7FA53BD623F43E1135AA8EBB947F267A4AD211E1F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278157, "uuid": "e430d0fc-4cda-40cd-b1fb-6875ef3bda83", "value": "1536:RgCa8F1GyhS3oDfX2YLKr35mzu1/ZLZBYL:RgCa8r4oj2YLkpmzu1BZBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780278157, "uuid": "e92ede6d-16b1-44ad-8bbf-db6c714b7db0", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780278157, "uuid": "e9e954db-2b21-47ba-b262-bd2dad78959e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780278157, "uuid": "4a2e6618-8015-4c4b-a6f9-481ee4b5bdaf", "value": "e54725fe55372f7f6c5459aba1fd5d4952a30a70c6f44c39f8428671931ec13f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441823c8-5db5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780316853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316853, "uuid": "d98f6f4f-c523-437f-b66b-e4d00859bda0", "comment": "Malware payload (DarkTortilla)", "value": "7a874e809e3048431518d16450ffd2f9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316853, "uuid": "979cd090-78a1-4163-ac13-1198736a825d", "comment": "Malware payload (DarkTortilla)", "value": "e5b8fdc2746717bdc8ba46d4924f05020926448f5f26f218e233bd6c3e287c3f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316853, "uuid": "4e199afb-95ae-4170-adf7-32e90f6052f5", "comment": "Malware payload (DarkTortilla)", "value": "703c3e7752303cb83848765cd204465d28d0ff55", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780316853, "uuid": "ef9bdf3e-1ca7-4d78-b207-247501b9207c", "comment": "Malware payload (DarkTortilla)", "value": "1120ca8df24e583918e77f6bc78db641d9aa76d7558c16e6ed0d80a3f4db4ed54751f742c87adddda6f2f2eadbfdbdd1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316853, "uuid": "99e40481-de94-40c1-9cca-29bd360a9ba4", "value": "T1F7F402692743D001CA4567305FBF1BDAD673DE280A3582478BA31AEDDE3BB6AE1D0D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316853, "uuid": "f16cfaa4-6974-497d-a763-e2456a3d85ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316853, "uuid": "c3d6961d-cfab-48c4-ba72-6db49a96d858", "value": "12288:nZ0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wzzu:nGFJz7c5a8uGrxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780316853, "uuid": "3b4c0c6a-3044-4528-a2c7-07cdf261aef2", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780316853, "uuid": "ce7eed93-1dbb-446a-b7ee-7a0f09da061a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780316853, "uuid": "b0b5a2f6-35f4-4e96-bbfb-2be204cecc8b", "value": "COTIZACION Q3_ELECTROMECANICOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75abfd2-5da5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780310148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310148, "uuid": "f97d885f-b2d1-4746-ae44-7eb632cd2a4b", "comment": "Malware payload (Mirai)", "value": "07b7c814c117db4728b6c09fe41bda77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310148, "uuid": "3f49da72-9077-45f4-9484-74374e4c1d74", "comment": "Malware payload (Mirai)", "value": "e7fd5d8f51b11b577370daa858c48e6e894cde5fc0422dfc04db564813582cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310148, "uuid": "cbca42d1-b2a4-48bb-b8cd-dbb73ee62724", "comment": "Malware payload (Mirai)", "value": "23f0fba9a8800150029b1f1c684117c2decd187d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310148, "uuid": "5c577af7-6991-4ac4-a2e2-8f2beb1a2adf", "comment": "Malware payload (Mirai)", "value": "8139da9a4fc66844ffb80b29b0334fffad85b0243ed8ba97519f1a3a5e1be0d4f657d8d35479dc792c50364482671938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310148, "uuid": "ded51b31-2c1e-4130-940d-fe00dc98c99b", "value": "T163044D46EA418B13C0D617BAB6EF4245333397A5D3DB73069928AFB43F8275E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310148, "uuid": "5bad2827-fe5c-46da-bb21-ce430fa6c570", "value": "3072:SvFDx9y6uqC5ajqg4narzfZc7TsmbppnSuHJpM/9r0G7uK:SvFx9eP5ajqg4nanfgTFbfnSuHrM/94a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780310148, "uuid": "e6403c09-f353-471a-a642-7d2ee76a2ae0", "value": 179342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780310148, "uuid": "9288ffeb-d746-46aa-8e0b-b98617eebc1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310148, "uuid": "0de06e13-ed32-482d-b71d-3e8fd97134b3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199dd482-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "aaec717f-4665-4d01-bf46-7df06338f0e2", "comment": "Malware payload (ConnectWise)", "value": "f5d5aa4f63f6318325ec94bf25650bc0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "3b4bb443-b649-4372-9ea1-22f4f97dc3ec", "comment": "Malware payload (ConnectWise)", "value": "e7fe7fbcd7648b473caf4db264caa4b44179e391520bd72ef2263f0885c0e133", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "9cd94a0b-4e6b-439f-9c3f-8f0817ac7e6e", "comment": "Malware payload (ConnectWise)", "value": "ddd60fea095548198a715e0b7eb60ed2e7f70e49", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "26219d2f-3199-43ab-a768-137ba407feba", "comment": "Malware payload (ConnectWise)", "value": "b84c87ca3b84b26d6d30894dcf890effd72f3df1f6a4556e2379529f1dcd64924983b8427618310d1b8dd1010cb1e8b9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "efbc7661-880a-4242-8ba0-22dea969bfbf", "value": "T189647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "122bc6f5-9240-412b-9a1e-6840d2e815d0", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "6e25d31e-ccb7-4ca1-8fff-8d3d40535a24", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300032, "uuid": "5cd4c6be-38c4-4c62-b001-0be03657ac8c", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300032, "uuid": "98307649-cc5d-4db0-b431-7c779b28f25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "4aab7e07-2006-4963-808a-9ce9c78fd608", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bdf526-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780346756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346756, "uuid": "0f950841-da83-4ab1-8b0e-beaceb24ed5e", "comment": "Malware payload (Mirai)", "value": "4c6ef77789eb3d099ea2a1c0e298dd89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346756, "uuid": "6fb91f99-a9ae-4f0f-9792-5db59f586d80", "comment": "Malware payload (Mirai)", "value": "e9aac8a3d62145fdf9d70c37edb7ec1355831006bb2b6cdcba05ba51ccd68461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346756, "uuid": "c97f5f98-9b4a-4032-9149-7e875e8badcd", "comment": "Malware payload (Mirai)", "value": "c0dca3f378154ef6368c1a55f06152b470be1a3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346756, "uuid": "d5389ead-66ec-4142-b31b-d7a7591e7139", "comment": "Malware payload (Mirai)", "value": "a7c87c9134d1e47393b370654f239b0dfed345e31a3662e96f8897f72eb67d745915612bde2a89be8ed6fe2bcd882285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346756, "uuid": "9f875dbf-c9a5-4037-abb2-79a74107550d", "value": "T1FF23F1DAA488E3C4C89C0DB4E15D4B17843D90903A7E4A1DAA40DCD1B2ADD7BFD5E09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346756, "uuid": "239b524b-8b05-442f-a310-b06f95b3ac06", "value": "768:iv/0Hn7joB9ldmlRRhYO2qR3q1t27hi1qsPYDArT0LIHqss7l/a9EO6mSzLgEW9R:VoilRROyQ2w1dPY0rT0LIKKaO6mGLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346756, "uuid": "0a5f6608-fb65-43cc-b993-b972d9da4f6c", "value": 48212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346756, "uuid": "9a00ac35-7e6f-4f46-a9a8-0324cd472873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346756, "uuid": "2e050ca3-b544-4eaa-acf8-a2c1d18b5f91", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28257ff0-5d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemoteX)", "timestamp": 1780279011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279011, "uuid": "aba9de7c-7587-4091-9eaa-a94d2f18c9e2", "comment": "Malware payload (RemoteX)", "value": "a07da03036316e2eaff2f46b00cb1b7c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279011, "uuid": "fe496845-426c-4896-8644-054e613f25e3", "comment": "Malware payload (RemoteX)", "value": "e9b2dbb0006d60e0171b735125e0d25f0f9fbee33c33a719f666adc945b25547", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279011, "uuid": "405104b2-4bd2-4952-bc9d-c21da423f1d8", "comment": "Malware payload (RemoteX)", "value": "0509144ec8c25c28084bd1d4b4154e5039e3ccbb", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780279011, "uuid": "a5eefa99-0dac-454c-ac23-1df7a5898758", "comment": "Malware payload (RemoteX)", "value": "8ca031560e2c7d44c77252a4fedfabf7902bd4af052af9cf5cfef1ad8f56c86b69472ae1f2b5da3e75e44206778c8618", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279011, "uuid": "b9d35758-3eca-4602-a2e2-9a0c124d12c8", "value": "T172372217FCA124F6C0AE9332886399963B61BC481F3167E72B90B6382FB67D09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279011, "uuid": "31744d68-3390-4b15-8901-e152e12ee4f7", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279011, "uuid": "528be5f3-19f6-4597-9acd-7a64020b5659", "value": "393216:GRkdQ3DBaONUnzrp8RE/iR4bLa83+udaFI6S2P1LqMYI6n/BC7ImMF:GRkwDNyrpsGZW87d+73tYIz7Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780279011, "uuid": "2bd38d4d-cd76-4a45-97d5-9c55e1a71edd", "value": 23699968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780279011, "uuid": "1d504dac-cfcb-41de-9341-b02e2eacb0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780279011, "uuid": "e607abb6-8293-4fd4-bf56-b9bcf051f2ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195300fd-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "35ebdb29-6337-4e80-9cc3-78d8ffb4fb37", "comment": "Malware payload (ConnectWise)", "value": "8e145324fa04540b5566d394ce237d52", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "31ac879a-79d0-40d2-be86-f4b0168acdd3", "comment": "Malware payload (ConnectWise)", "value": "ea7f608e0d0fe8dffbde3acfc6afdb5ad9624c31b21eaf1589c5f8f35332824e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "4aaafc13-5dcf-49a3-92ac-603e24a7be79", "comment": "Malware payload (ConnectWise)", "value": "4cfc02763db388db7c628c07b58bd301e7c9c4ef", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300031, "uuid": "49426456-303b-46e7-b727-b8c4b4d3967e", "comment": "Malware payload (ConnectWise)", "value": "553fa638556279a2d299a6b0a556c7cb0ad6f3ad9fdc3021354185bf936c080168f606304fdc061dc2ecee8b2c1780bf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "ae622b02-efd5-4ea5-a903-eabcd25151ab", "value": "T16A46E141B3D695B6D1BF0638D87A526A6634BC048316CBFF5394BD392E32BC05E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "3ea6c10a-413d-4591-866f-911d80915ba3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "b19a7677-7ae8-4d9f-898f-83592dccfbda", "value": "98304:gzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ghfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300031, "uuid": "40b9f9a6-625d-4ca1-8e95-f90ba3a40cce", "value": 5655304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300031, "uuid": "1438a3cd-826a-4e68-9b57-d0e232387621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300031, "uuid": "7ed2d02e-4ac3-4e65-980c-cabc357e4a43", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05010e42-5dc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780322331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322331, "uuid": "5e815956-ffcc-47c2-9215-001a7f1939be", "comment": "Malware payload (Mirai)", "value": "fe5ee0c5061c25be2a03fda0dd33c3d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322331, "uuid": "aa7543be-4050-4261-8d2a-36f9df4658fe", "comment": "Malware payload (Mirai)", "value": "eb61f7152881753f07b771bb10b28aa0194168edadb6bbdb4390b1657020d97b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322331, "uuid": "ad47f191-d933-47c3-86e8-63d416014718", "comment": "Malware payload (Mirai)", "value": "6d498ddbdfd98761598b11b662580407c87ea0da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322331, "uuid": "8f1b8eb7-bbe2-43dc-b74c-4c5b7c9ecbe2", "comment": "Malware payload (Mirai)", "value": "219b9ff61bfee578f153b05f7080a7958d6dd8a43639e6445b5c25ba7f5b8b74cf3e47a30c4bb569fc3759bdf90294c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322331, "uuid": "a2491891-f7c6-4a8a-8f7f-155ab1e9d71b", "value": "T12D73AE26D4265E55C26841B070E8CE791F23E5C063872FF626AAC3B5A097E5DF408FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322331, "uuid": "c1a057b5-ee81-4b87-b684-8cf7b745e79d", "value": "1536:I2rJRfuQkQ8jUmBKRpSI7TSLDVsbCG5mTbeHEHw:IWA/Q8jUmIRRExsb7wbAuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322331, "uuid": "4fb37fd6-41bc-4cfa-a1c9-0a57a794503a", "value": 75820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322331, "uuid": "b9872185-0d10-45eb-9002-5e6f3d2aea29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322331, "uuid": "28dd3b27-6f1e-4e37-9eaf-fe01bd5673c2", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18412e18-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300029, "uuid": "04be4769-b9d5-4552-9384-bdfd4e6bf49f", "comment": "Malware payload (ConnectWise)", "value": "064ab6f96a2a5777df5438e9d115cc0c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300029, "uuid": "65fe6957-a03f-4ba5-aada-f6c9e3e39593", "comment": "Malware payload (ConnectWise)", "value": "ebdeddea3e27f47ea658ad31160b5ccf64f729a39cfb0ad5ac9c0837dd055c5b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300029, "uuid": "64f75472-b501-4c80-877b-3793713621fa", "comment": "Malware payload (ConnectWise)", "value": "1e8cca1ff0c8be0cc2a03a34a67a9ba5b6931110", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300029, "uuid": "59125218-e4e2-4506-8c03-8036056ef4b1", "comment": "Malware payload (ConnectWise)", "value": "660023a2ffe7e9853f3eb25e9afc5b07c982132255be37b4a0c3afc7f7d511cf1656d298d49189820c844227ff286612", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300029, "uuid": "374720de-20c9-40a6-b08f-0e1101f13968", "value": "T11B46E101B3D695BAD1BF1638D87A52656774BC048312CBBF5794BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300029, "uuid": "945389fb-5e2b-4da5-bce4-7ad7abf8db93", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300029, "uuid": "554b94cd-d0c2-4249-8a1c-eac5a42c9d81", "value": "98304:rzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zli:rhfefPtHxcp9ym3nltDUJVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300029, "uuid": "5ed14071-e3dd-4f6b-ae5e-d9ab845c5643", "value": 5730136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300029, "uuid": "bb7daef0-345a-46ac-bc35-a33e1aac4506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300029, "uuid": "3cde1112-76d8-44a8-8a68-0d53d566b50c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef4ff36-5dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1780346856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346856, "uuid": "ad7d8261-b9a5-4e04-9618-55009867c3ba", "comment": "Malware payload (LeetHozer)", "value": "757c7f5ad9bef627977961d0ec8bd7e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346856, "uuid": "639eb6bc-0c89-455b-b3b0-f83e226f1cf8", "comment": "Malware payload (LeetHozer)", "value": "ec2743bc10f9207b04b2e96badce4e5f564da05f35e5a06cdc268d4a4f8811f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346856, "uuid": "c0a6310f-284f-4e43-88c5-7075a6566ac1", "comment": "Malware payload (LeetHozer)", "value": "553b2c0267d9bd41283f3f979d532a1c30123564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346856, "uuid": "2ae27b3e-8ee2-40f2-84f6-40345110aaec", "comment": "Malware payload (LeetHozer)", "value": "3e39ae3c53da635df4cf73d89ed127259404bc6f290d9f4f3dab9cbc56a065b4ef97b3f68a9d4b9ee030aaedd6c33cbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346856, "uuid": "8bc0ce0a-9f5b-4dd6-9779-95ac47dda1be", "value": "T13E23F1E381DD80F1C5B3A1FE5A775268E27F9725430A121B186E30A84BBB47C7870B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346856, "uuid": "44dd0e78-ead9-4760-9d60-341f4187fe8b", "value": "768:gANFAkBxvsPmeBBQujbKvKzslNzdJGwyD/2crr42NjGGUoTfC/E:pFBvsPpouj+vK4LyD/bA2A2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346856, "uuid": "a11cc5db-f884-43a8-84b2-ba7d4c557b3a", "value": 45880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346856, "uuid": "1cf808d3-4bed-483e-bc79-22c8bf336d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346856, "uuid": "2f91a7ca-4dcd-447a-aa87-ae8c482440a4", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8502b2a9-5da7-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1780310949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310949, "uuid": "7292ea3d-2228-43ae-ab43-3e8dbac12701", "comment": "Malware payload (SilentNet)", "value": "05040670071073341b10cad117875bfc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310949, "uuid": "477c0e73-f185-450b-8f8a-c073afae18ed", "comment": "Malware payload (SilentNet)", "value": "ec413c4fdd42a843de651d6c854f129f779eeca0d7fd14e5a329153706075ce6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310949, "uuid": "36c0d58c-868e-4441-9e9c-f4d11d648e25", "comment": "Malware payload (SilentNet)", "value": "27ffe8f3f4dfc8f1a32c0ee01739434392734aa6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780310949, "uuid": "f47ffa30-c621-45a1-b66b-0859502b78e3", "comment": "Malware payload (SilentNet)", "value": "7d20a7a425498ca7b00d3760d445a70c55f68075f7aec9fb70656852a40f444c7e47fe060dad9704c243cccef7acafc7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310949, "uuid": "73596c3e-c48a-4352-b67a-104188048b1a", "value": "T1FE053306400B6460DE39AFB08CEE445BE6B65F790B060B1E4A71F5DBDCB8A9DF1CD894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310949, "uuid": "d578e72c-354e-463b-ba46-e816d9482a00", "value": "12288:jUVIQ050IqGF45B9yIRMJv0gHTHtl7ZrDDIcgygKaKEFv7NmddJKCbNOpk9lq1:jVQ0zrFItRqTP9HgFlzmddzROG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780310949, "uuid": "91aa2c46-47e5-4c62-b553-15ea73702676", "value": 834932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780310949, "uuid": "4fef13f0-aacd-4dfd-8278-c8476fd7e906", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780310949, "uuid": "2990edf2-0e1d-4775-b7f8-d72394ebfab0", "value": "Krypton+.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7fa3a5-5d80-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780293995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293995, "uuid": "4c6337b9-4beb-438f-9c91-f99455c38db6", "comment": "Malware payload (AgentTesla)", "value": "38c815e7f118fb28576ecf20773d21e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293995, "uuid": "5dd9c99c-99c0-4dbe-a54e-d6da4b9e3917", "comment": "Malware payload (AgentTesla)", "value": "ede6cfb8415518ad6598ec1ed1899183d9fd8f61534f47840ad3c2c85a59bcb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293995, "uuid": "a1e4bc09-7ea7-4578-bba3-4063e95ed05e", "comment": "Malware payload (AgentTesla)", "value": "dda5fb98ac79c334cd166ffbead29989b83b4b6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293995, "uuid": "29c869c5-d23a-4a58-99c3-d0f5f2bbdf34", "comment": "Malware payload (AgentTesla)", "value": "bc04bec53468157fd634482e4dcb1ab391c8667ad2ae7fada81b83f1141b40d07934511645aefd8faff45024d794dba5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293995, "uuid": "04b23319-5ad0-471c-b3fe-197cf6d1b7ae", "value": "T166250254231ADE03C4964FB41A61D3F412B44ED9AD22E713DFDBBEEFB87A6416A00391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293995, "uuid": "1270154e-96d5-4723-afb0-1302ed122bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293995, "uuid": "996b24f2-6157-42f3-94d5-ac9f2c18bf2e", "value": "24576:TiPIsE+i3n04Ot0Fwz92Q+Ps6CHnEuy0bhAEFT0D:TiPI+204OtyW2qnEJ0bh3FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293995, "uuid": "3e9d4074-74e8-4ad2-8062-b1543a086cc9", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293995, "uuid": "bb749661-099c-4512-92d3-535144561029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293995, "uuid": "c045b45c-38f6-4078-8e9f-3e3cbfd4f6cc", "value": "Nota de cr\u00e9dito n.\u00b0 FOB 4031-143-4101-4099-4100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41584b58-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "345ada87-6b0f-4438-8a9f-24805bdf76e9", "comment": "Malware payload (Mirai)", "value": "17b099b13eb9e430624b4bd43fe080d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "1ab8df57-bae0-4b44-9950-01fd679fb70d", "comment": "Malware payload (Mirai)", "value": "ee11b70a0c9db312a9c48ff6ce5e6c18147165927d0011c1c3b888e16bb83b69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "c2a61e5f-784a-4973-aff2-5efcb39bd984", "comment": "Malware payload (Mirai)", "value": "1457c796a1dd6a642a8f9ec512308653d1960e7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291508, "uuid": "bdb5a478-6a64-44f0-a60d-df6cb86e9d70", "comment": "Malware payload (Mirai)", "value": "6a3fb6daa92c0366ec43a847f653744fdbe2b2dfcf76f31af89482c7fde7d30f8a6d16ad3c120a364a180afde03e585c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "e90cffa6-f3d9-4dd5-a9b9-0f28b9593a93", "value": "T126C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "bb985200-1b01-42ba-abe4-af8f80885d08", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPNWO:LzhWutxBaORaebXQd+mzBzlkNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291508, "uuid": "9b9182d6-641a-4712-9483-fbb920ea6600", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291508, "uuid": "e6fc0373-0b06-418e-bf9a-e71007c72358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291508, "uuid": "986f3de8-5267-4e44-8a3f-066f3bac8aa5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc066732-5df3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780343791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343791, "uuid": "cbe9ba91-5c35-47dd-911a-a54317666874", "comment": "Malware payload", "value": "2ce9c502be29b9ec050749b571e332b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343791, "uuid": "b16e628a-1e68-4c00-acd7-d7e6fdab5e3b", "comment": "Malware payload", "value": "ee8b9057db5d1d7197ba91869ec4621274f418e734351d61c037c97be1679a0c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343791, "uuid": "b52b76d4-e4c0-490a-8d93-1d62c53df9db", "comment": "Malware payload", "value": "d9a6bdea48a68104a0609fa6768b9b70d62f9b8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780343791, "uuid": "8f04585d-a7aa-4c32-a86c-8f447b92d8a6", "comment": "Malware payload", "value": "3a5fd861f8eba699d7928200c716eeb0d43e911b11860c45b31b5e2b5b9506ea76d9ce6bfefc1cc97e9bd326faf37314", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343791, "uuid": "699d8c78-25c3-4c6a-8cca-574cb505450a", "value": "T13A136C6526953C25AE99883B5C7E2F0CBDA983E2304491DDBFCA3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343791, "uuid": "06b7bc23-33e5-41a3-ba17-89be99a6dbe3", "value": "768:Wr9NyXsZztCs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:gHusZMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780343791, "uuid": "1d9d4c29-6038-4768-b55e-ddf5ced5171c", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780343791, "uuid": "2f502432-134a-42e4-85bc-8a98e5ab7aea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780343791, "uuid": "aac955a2-f756-4462-a5f9-69049e97d9ed", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683bb85e-5d7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780293721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "d821a9ee-a726-4371-acf7-8606628574dd", "comment": "Malware payload (Mirai)", "value": "cd6084ee7a16ada147159b3c970a05c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "31a029cf-9e87-46b8-bc02-171918befeee", "comment": "Malware payload (Mirai)", "value": "ef1802d9ba063d1c688fa592476bca567c808fbb2e72158252f8e40e28b68812", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "f8ae9d5d-f5ce-4846-a334-41d5eb02d0a0", "comment": "Malware payload (Mirai)", "value": "035acad0856f4f1f37535d3a2c651fda83222d6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293721, "uuid": "259f4e7a-7b7d-43f1-bc5c-c6c71f9dca4f", "comment": "Malware payload (Mirai)", "value": "b49d120e71190695d70e38ad61badbf5c11488cd1e5314fcff01b6474f759de5b03696b6ac5e216c61713c5435dd926d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "b7b8f70f-d153-493a-882c-39218d553272", "value": "T192A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "814e042c-7972-4b6a-a7a4-592c7ab57bc6", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8Qkaa:ip3PSVWxHcqRhzhNPt8Qkaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293721, "uuid": "fcae01d3-5829-4bd7-9bb3-549a12aa9781", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293721, "uuid": "918572d9-5d50-4a6c-b8d5-081a258b614f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293721, "uuid": "0aa47e78-1ad1-4fe6-b00e-eb7fe24de84f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b35241-5dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780327961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327961, "uuid": "024d69a9-f6b3-47a5-828e-ba14b9a6b01b", "comment": "Malware payload (ValleyRAT)", "value": "a5d4474a0e4545a3718402bf2a2a8eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327961, "uuid": "b0a473d1-5d33-424e-8f91-56e98486f210", "comment": "Malware payload (ValleyRAT)", "value": "ef662d69f7237acdc451b8800c648de4385afcd7f0dbaa7ab8ed6def226d5e19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327961, "uuid": "3b832fb8-9538-4eb0-92d1-4f51fef13b23", "comment": "Malware payload (ValleyRAT)", "value": "41f93a69a70db0e384f4a048d7e7806e05d335d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780327961, "uuid": "1b7f5d2a-a1ae-4cfe-91c1-d0872815c110", "comment": "Malware payload (ValleyRAT)", "value": "ebd52cd93eb949bdaea9ea818866104e1ebc3641ffcc077526d266a166055a71e2a535383ae5d624e83366630bdf9147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327961, "uuid": "72559950-3ee7-47b5-8455-20fbafee9751", "value": "T18CF79E4AF751CD56D425533898EB475033B2E4A40B6BC3A3371E773D7EAB3A84EA0990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327961, "uuid": "a6a97bee-47fb-4970-a846-c62901c5b098", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327961, "uuid": "342aa69f-2359-4770-8585-a4b8a87aad91", "value": "786432:cftXNlNCxdpGIpPQXRUvoMo0h3248y4kkAWOQmrqykFq+a498:2NORBvoMo0vGAmykJ98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780327961, "uuid": "f4417062-5446-4015-84f0-599febaf723e", "value": 74043136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780327961, "uuid": "95b30f01-9e3f-4770-9cbd-8ccda0c3312c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780327961, "uuid": "287b91f3-a629-455a-8a02-a8d2d9537fff", "value": "amh8535633203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45648aa6-5dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780340478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780340478, "uuid": "889e2003-c65c-44b9-a8aa-1e42446198e7", "comment": "Malware payload", "value": "5ef7bf4ed52be2a6d5ebbcf3076fba5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780340478, "uuid": "a01d24be-9cee-4b27-a5e9-d7ea95d76dee", "comment": "Malware payload", "value": "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780340478, "uuid": "e89d9a35-c3e8-4d7e-9afe-40c334a4d2c3", "comment": "Malware payload", "value": "9e03e983e26d4782a3fef0a6ebb47fdcd46974c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780340478, "uuid": "bb645d7e-4a38-46c3-a765-3abbc91433cc", "comment": "Malware payload", "value": "dbe363bf6ae9ecfdfb86cf39a7bfa22fed299b56f3386b38cc1b6e536b475c582ffe25c4f0ea71702ca3eba66fd1950d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780340478, "uuid": "3f7ff8d9-397f-44d8-9ef5-9e22aacceba5", "value": "T1A9459F16739802B9E17BE17DC9974A46E6B278054330E7CF03E496AA2F277E14A7F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780340478, "uuid": "5146d7ad-be11-4e87-812f-972e330526cf", "value": "0dabd40aa2a4ec7b32954eefec89a3c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780340478, "uuid": "d73b5309-7177-42f3-b436-90fea97bf0b0", "value": "12288:bLL0VMmPPvq6NXRTp7A2jsb3yDbe7qDu6ZPIFqYUrIcOR5XQRd+V2z3hrAduEYR+:3KNPPTXRTK2+GmFMIcqQqVg3hrrFHRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780340478, "uuid": "70233474-1689-41b5-963b-517c02e12a2c", "value": 1268336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780340478, "uuid": "6ab8a4e9-ae29-4883-a4fe-8115308dc49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780340478, "uuid": "a82f850e-f1e2-4ea1-ad80-9647d0fa552d", "value": "cf_ch.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a136c84-5d8e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780300032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "5372f7e5-e516-4ad0-aa1c-b96af805d502", "comment": "Malware payload (ConnectWise)", "value": "59b7ef3876b32d6e76060afd5175647f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "edec6144-5a86-4af1-893b-ebcf7f5d47ef", "comment": "Malware payload (ConnectWise)", "value": "f1f46f5010ce1d182021e54dbd77099c94efcc23c2925bf4d777e052b84db65a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "45f4d8a3-3b7c-491a-98f5-e5f966ae3885", "comment": "Malware payload (ConnectWise)", "value": "477d567423562b8ade908ffc0152030e633448e5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780300032, "uuid": "5a34e040-ef94-4811-8a63-09206656c948", "comment": "Malware payload (ConnectWise)", "value": "cd0ea2a4ed0e97776d65424092ddbff227ac6177399793ee0c875ba18718de8cd8c9e74b0e3271f27dd2612922cf768c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "6b561410-a885-4349-a9d6-1eeec7ef5575", "value": "T15C46E101B3D695B6D1BF1638D87A56696734BC048312CBBF5794BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "6f4bae0c-085c-45a3-a547-b6824990bd2a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "32549dee-dafd-4771-ab63-4d7595c0bbc8", "value": "98304:yzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:yhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780300032, "uuid": "dc263f5b-012a-4e54-9bdb-b1f830784109", "value": 5651800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780300032, "uuid": "383dabfb-9dc7-46d5-9ff1-6c50b1a1a7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780300032, "uuid": "eb1493b5-47f2-4832-8b9a-1cd6bb85ff39", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10c9dbe-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323559, "uuid": "1b02a136-ad5e-458d-9b97-6e623fb6405b", "comment": "Malware payload (Mirai)", "value": "317ed6fb1d79b7b1edd2f632819ac040", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323559, "uuid": "cd089d3b-735f-427d-afd6-7627ab41683d", "comment": "Malware payload (Mirai)", "value": "f29525ef6bbc16debc7a1db3045899727be9fd7b80798a6730fd2bbd782ed932", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323559, "uuid": "d4432c06-aab4-41a5-9344-bfab8771fd2a", "comment": "Malware payload (Mirai)", "value": "107b79347b23932f43f49132ce9a42722e99041c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323559, "uuid": "71bd1c3b-e4bf-43ff-ac6e-93d83ae303de", "comment": "Malware payload (Mirai)", "value": "5ef7693501c7ab0f7eef5f6d85c6bee137ead0d61dc9665d4baf4c7cbadfa59d6c1aa06324905a5e0da4943da7690600", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323559, "uuid": "80d03344-e063-401f-b146-2ea055dd68ca", "value": "T11E262951FECB84BAD503193014ABE2AF27306D054F24EB83EA547F6AED7B6921D3614C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323559, "uuid": "ecf603ed-56e8-43fd-8997-284f7cce089b", "value": "49152:eSwJhvL0fj6b3QqDOywjFSgOPndbBGUaDBz6yGosBjukRDxnBSOwe7DZievmfX0N:eRr7RqywTBz6yGOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323559, "uuid": "51c62eb5-b2e2-4189-af2e-411b397a3dd9", "value": 4501504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323559, "uuid": "2c703a1e-ac07-4aad-84e0-6e224cdd7633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323559, "uuid": "6313a36a-2f8e-4fc7-9f8d-895f47aa56fe", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916a0036-5d7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "aee784aa-7d3d-46fd-844d-2ffd8e8ad5f8", "comment": "Malware payload (Mirai)", "value": "fc5c01f28da11627a9e883fa22be2758", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "43767b3b-eec2-467d-8a0c-be44f8d3e3d6", "comment": "Malware payload (Mirai)", "value": "f3413ab438c85f9dd4c12e2c5df61c24ed5a3ba197edc9f9514d6cfbb72a10de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "cd03204b-d270-4058-a998-4548ce44fc88", "comment": "Malware payload (Mirai)", "value": "8519aa27bae6e4756d3528c88e466779fdb39c49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292931, "uuid": "61a12168-72ea-4dc3-9c8a-9a9102591045", "comment": "Malware payload (Mirai)", "value": "3d30708895d0f4c2fa16e3a886dce9f92df8ffc8ea209f9ef2f15c937805ff30c37687705a8d7b9d68c4d6f1eaa775c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "5b41a84c-006e-4975-99b0-63fff7893b18", "value": "T1F2731911AB080D7BD4F75CF4447B4329BB855BC702E588150839EA435BB1BB3678AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "1f8ba99e-3aca-4508-bbcd-10cb742740da", "value": "1536:7rTL/iS2MqtLxngiFZSXEDjU3KWLD2may0JokZzmdLtVAASo8nvD2A1+vShCqqK:vTLaMIgvE8aWLD+y0JXZQxKASoQDqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292931, "uuid": "f1ec38ad-78bc-4d3e-ad21-a95885a391f8", "value": 77772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292931, "uuid": "a6a1cfe9-faaf-4062-a1ce-c43712c71fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292931, "uuid": "dd7f462c-d87c-48a2-b220-0988175415da", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555f06c9-5d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292401, "uuid": "db3a99da-334f-4393-9fc5-6457a6bfa7d3", "comment": "Malware payload (Mirai)", "value": "cf2c1395d01c497210cae31411540bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292401, "uuid": "543d1bd6-32be-43f0-aa89-8da4ab374ad7", "comment": "Malware payload (Mirai)", "value": "f49df2fdbe4c63bcebdfad04d20289ab6c227f33e455c43bf5fd8edb1e6d71d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292401, "uuid": "fe958e64-62f9-41cf-ae32-e9f4574516e9", "comment": "Malware payload (Mirai)", "value": "b5df72c8c066cb6b1924d8eb976612d54d24b5d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292401, "uuid": "665a7b72-6b90-4b3c-9cab-be34a0451d6e", "comment": "Malware payload (Mirai)", "value": "83051e412e9a22ada5e2a473b0f3d692e04e434f2fd73e1d1cd701df867016b9b1ff3889bea3b41b757670eeac57dc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292401, "uuid": "89772f56-20de-4641-9856-b5f591a21353", "value": "T1F373F691BCC28A2BC1E0137AB6AE658D3321B3E8D2CF711BCD504B20B6D551F1D6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292401, "uuid": "8ba3ecc5-7a8b-4373-ae91-79b645a59e9b", "value": "1536:UK17f6D/9FlNp/GIkkNdLJyHWmOsREvvJLseZ:UKhfM/9FlJLsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292401, "uuid": "81181a2e-0af6-4289-9bee-907fa3bf8533", "value": 76292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292401, "uuid": "92f6714b-b0f1-4798-91bc-69d5ea35eeae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292401, "uuid": "b3b4118e-ed30-4161-a475-9b98cb91c27c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b08520-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780312219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312219, "uuid": "30b2b0bf-35c0-4401-a7d2-50690560c4df", "comment": "Malware payload", "value": "212020c940661d72bdc8c42ee1a8421e", "object_relation": "md5", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312219, "uuid": "6cbbf1ce-b53d-4274-84dc-0acff41ddb0b", "comment": "Malware payload", "value": "f6403fc468e123672813e9e2fe0e1b33d0c7d4eae03017d6093f9387cdf72936", "object_relation": "sha256", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312219, "uuid": "eb7524b6-c8ec-413e-bd68-9c2f55b88bad", "comment": "Malware payload", "value": "d850b1dcaa146ea6083a43297b4b33ffba7f69f6", "object_relation": "sha1", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312219, "uuid": "c47ab591-16c5-4352-af3d-2e2530665381", "comment": "Malware payload", "value": "65fb4f3d318518e1bfce8fce6728430b2d5005c23f6d6722e26f6c3f0138e30b0fd3132926abf446974b87fc90b98280", "object_relation": "sha3-384", "Tag": [ { "name": "192-227-135-225", "colour": "#6B26C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312219, "uuid": "d332f6f5-33e1-4bcc-bc91-771e2c38edb5", "value": "T15024F15A5B43150E8A18A613C977BECD2AB816D1C0BB1EEF0B4D7C6C3451606375BAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312219, "uuid": "1191e260-d05d-45c6-b4e3-e23afde882d6", "value": "6144:CQpVcWHRjkCCMl+lXV8G2hTwY4I+G31NtO:rpjHxkNlF8ZV0I+G3ztO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312219, "uuid": "7eab1a58-347a-4c39-98cc-5533d42a5138", "value": 213212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312219, "uuid": "7adcc97f-c2d9-48c0-b74c-6db388e14c40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312219, "uuid": "3ed8974f-c1b2-4b45-84f9-2c3ac3574e19", "value": "Bestinksp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bb33f1-5daa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780312400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "04ebd5d0-f792-412c-9840-6a69a6370af7", "comment": "Malware payload (Mirai)", "value": "8e264a12e2ab4e86df1d8747a057b326", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "91f044fc-3d94-4957-a235-4f58198456db", "comment": "Malware payload (Mirai)", "value": "f6c19972c7868d2aba77121f00237c9094eb6a32c7bcab31bcb6e17617bee280", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "fa15854f-f062-41c8-8610-ef230bb1cd1f", "comment": "Malware payload (Mirai)", "value": "1fc87550418ffb76b6fb0d9b625877cb2f271166", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780312400, "uuid": "c65528cb-d2cc-4ab2-8936-646462539f24", "comment": "Malware payload (Mirai)", "value": "19f148282c2097faf76b36a6f1df1212fb81861b7c9b5a2a63ee28fd6559ff8930f664a17ff067470b23fffcb8f15ac8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "958306fc-304b-448b-91af-b07fb92e03a6", "value": "T1FC13F1F90310454DE5BDE1F8627B97E93B3006B1DC81A9C379AEAACBC958C6835437D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "4df6fda6-f59d-42b2-952f-5fa5036310e3", "value": "768:W3HQSGrNCfslD2ES6/fhlG9NIr0u+yC9WAtU/cZ2M4ywRxNMIjG2ZYXDkWeJgGlz:cwSaNCo2EJnG9WbdC9WAtkXx6IDYI9VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780312400, "uuid": "e1815b29-3dd3-43f1-9547-b9fea5f58f21", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780312400, "uuid": "5c3dcc20-7886-4330-b8a3-393c3e29c17b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780312400, "uuid": "4bdb8a27-73fb-4efa-bbf5-bf2726ce2fe3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930cc860-5dfd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780347910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347910, "uuid": "e9c66deb-8769-4f2a-8584-ca40daa14f66", "comment": "Malware payload", "value": "d82536e30a5139f19c1dfecb6b194c61", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347910, "uuid": "833ca3a4-b5e8-4055-bcb4-d5341e1e5c17", "comment": "Malware payload", "value": "f6d326bcb8dacfe6b808afa487e5238c442867f06799b7c06d7b705dd1b2de99", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347910, "uuid": "94ef4bd4-8ee9-4cb4-a0d0-484c27b68dc1", "comment": "Malware payload", "value": "37880f7285458c7983d002b574e57394d7e2c58d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780347910, "uuid": "84b3b312-a07e-4672-a89f-deca3f4decec", "comment": "Malware payload", "value": "22dcff33639ef1d4970796653890313e68be3fcb56b23b46b9b123a60b612f41f5ac6e06c3ebdc4829f4bd90bb694ae9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347910, "uuid": "8bd2b490-3f05-4f0e-88dc-9973d84797e2", "value": "T14816238FBCD92BD6D2601674352DA0D67AC20B60CB512F77AF78BC6A18F11A88F71543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347910, "uuid": "cf23d6ed-555d-4e33-9986-ad8350ae5137", "value": "98304:e7gCf9HSQ2FKPI6GEdIqz5fd1lzhBEKBfAAaaRM78Q6iRican4Tf5Mtn:6FypwPI6Aa5fdzhBvBV1jiRif5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780347910, "uuid": "8fa8fe32-1485-4a26-b7e0-f7dbacdf7d2e", "value": 4033536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780347910, "uuid": "2a86de7c-5a99-451d-a4d1-cff7c14399a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780347910, "uuid": "547effab-286e-44dd-b075-6701639ed1b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f02f85-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780293521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293521, "uuid": "af126518-fe35-4af3-b278-ef50c0021b5f", "comment": "Malware payload", "value": "142095bbc3a072950a5f387e81713f77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293521, "uuid": "d0da274d-a8cd-4db0-a077-c10d5f7d229b", "comment": "Malware payload", "value": "f77e3aa9821369459cc48ccd1ee56af9b20637bca393fbefdf059fd377732891", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293521, "uuid": "51ec62d2-6b88-49a7-8cd8-2484a61ed96e", "comment": "Malware payload", "value": "6b93fae3387bbd80d8f9e9e776175aa029e07ec6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293521, "uuid": "d1b9f6e6-88ae-41a3-900e-8044f9db9b7d", "comment": "Malware payload", "value": "14539980065aebce144f1cba6b9c39a1e70bcfffbb21243b9371caabb01c73cdbf7a42632111139d0906f2434526ad92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293521, "uuid": "a6f2dac6-9575-42f4-bcd8-899eb9863ac3", "value": "T1FE01999B51B0AC3068B5893CFD9646A0104714176845190D749F7E04EF2CA4CF6A1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293521, "uuid": "7ba4bd75-6eb2-4814-b6f5-867c30c7346a", "value": "12:Izzfsx80+al2LeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TalHHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293521, "uuid": "c5548f0c-4f82-4cf5-b66f-c7fc76063462", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293521, "uuid": "efd05d55-0f72-4cb3-ba75-26c62606281f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293521, "uuid": "667d01ba-5940-4fdf-a417-b67673b4cacd", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c92bbd-5d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780292179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "fa2ba6bc-e6aa-42dc-842e-8735bbe09e9b", "comment": "Malware payload (Mirai)", "value": "9640660e10ccc7ae33e17173aa366b62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "e0da05bd-0f3b-4d2b-9ea1-b821a62b8992", "comment": "Malware payload (Mirai)", "value": "f9ef2c485beb0cf5024cf0d66e91da71ddaee6a6d6eb34ffe287c4fc9cb64c36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "a9bfe8c2-b2a5-4553-87ba-1b88f522ca94", "comment": "Malware payload (Mirai)", "value": "5e32077c5b330d2afb5d108f3e4dd6345af9f07e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780292179, "uuid": "bec97a4e-169a-41b8-b441-4b7734aefaa6", "comment": "Malware payload (Mirai)", "value": "ffab6ccb51fb0502f1844aa38ef521be092b5e5d2a1237ca11f90dcbd63be9ba2d8b4b0b5487013b8f836af8c7a8bfe4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "6f9349d9-30a5-40d4-94fd-57f091ab6b59", "value": "T1FF732B81F54B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "59bb8c10-32b8-4aad-ba45-f9f7dca7a6c7", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHF:uVFrPNQn+WVQ3EXVUk29jgxOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780292179, "uuid": "e80b148f-908e-4b01-b2c1-42819404f7d7", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780292179, "uuid": "4706a64d-9333-47fe-a1f7-d36f4dee48eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780292179, "uuid": "65a8529d-4ef7-4318-8ed8-b35122259ca1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b05982-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780293522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "b112beda-14db-4bcf-a04d-2e85fcfeb894", "comment": "Malware payload (DDoSAgent)", "value": "36593db451db80c38e615740efa3a5ce", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "67875915-4c24-49ec-ac10-bf7a4e9e7c5d", "comment": "Malware payload (DDoSAgent)", "value": "f9fe2d56235727bb252612c130ea8fc5468eb537a06e680f5027fa4bd105a204", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "cace40b8-19de-48ac-9957-34befd754789", "comment": "Malware payload (DDoSAgent)", "value": "d9f4d6513828da35107c4b73fd020816ad798a08", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293522, "uuid": "b47ac551-91b7-4c1a-8b2c-32f58e214449", "comment": "Malware payload (DDoSAgent)", "value": "ee82dc50a7e89ef25a643937ade4383cf557d071557cf8aca44ab1c4dc99fa88b2daf3aefece5cd920ea3d7d49d16ed9", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "ac58f24d-4516-43bf-8d44-84948da5b369", "value": "T1DD864A137A29EB0FC62821300DB2CA942B691C9642D7911BB745F309F9F21BD5DAECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "8f9cfc31-3246-4588-ae39-c15ac4c8d9b1", "value": "49152:glVZvmsNoaASox/PGQa/jtDf5xaount+fqECXKEuXngHYJ/7FwsJirljwia5pp0G:GtzVbWjwiQ0kcP+rSi6NGnUjEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293522, "uuid": "4c21cc73-ec45-4452-b01d-14fb3f872feb", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293522, "uuid": "760ee3d2-aabc-4d3a-b9af-46239bc614f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293522, "uuid": "7142a906-67f0-4290-a6bc-49722d0a108a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4976f97f-5dc3-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1780322875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322875, "uuid": "2958b905-55f2-4ec5-91bc-0556c79ae4af", "comment": "Malware payload (KongTuke)", "value": "60a372d1279eafd56631c47471992e49", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322875, "uuid": "de478c83-f70b-4bc1-8e3a-14970702727a", "comment": "Malware payload (KongTuke)", "value": "fa0af45e17e3bc6e05d025f34ac37005b4914014fb24bec2fd077f2a197fbc78", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322875, "uuid": "69a0386a-5963-4160-bcd2-9f35997cece0", "comment": "Malware payload (KongTuke)", "value": "5ab025945f9f21cb7065b5df140fae41b0f8242a", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780322875, "uuid": "586e6104-ca8c-4b6f-8780-81477b9c35c3", "comment": "Malware payload (KongTuke)", "value": "4a18e5c97bc2ab88a3e1ad5f53703b9bd94186b6ccb562e7b1524c15e17d4094358b8ccbd4c11e9bc25cea6773891830", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322875, "uuid": "22b6626c-8f59-4de2-94cb-c0a10fe4cae1", "value": "T10F355C5AEBF64CE9D8E2C0B045B72310EA3039D547505AFF566886282B2B7C0B73D779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322875, "uuid": "0f17910d-97a1-4f5a-a1cd-45e5f443b7ad", "value": "24576:Wihx1hQVmTTY8cBChpkFCWiDgM3wWRO9aQ7ksk6ahymU8n0T94W:Wihx12VmnxhpwrawENOijUyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780322875, "uuid": "e557bf7b-2e55-4f92-a57c-95c15a855a01", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780322875, "uuid": "d01ab12d-e270-4f5d-9cb9-9e62fd32edc2", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780322875, "uuid": "85ec2933-403c-4f77-90b4-547cd69c6a04", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b701ca1-5d8a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780298505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "3ee34dfd-b2ee-4fe1-9b47-89054c28d376", "comment": "Malware payload (ConnectWise)", "value": "8400911fc1e7f59704eec88772e2b2b1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "1018a5fb-e015-4a26-995a-95fc5b0deafe", "comment": "Malware payload (ConnectWise)", "value": "facb147464759e3ce625baa23e5e3859cad56791cb0b771aec688472230761d9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "ffcc3fc3-992f-4edd-9397-48d705742981", "comment": "Malware payload (ConnectWise)", "value": "3d4c35eaec68fb611642958a9467d0982ed33256", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780298505, "uuid": "73e9b48d-4420-406a-80e8-c6cc9492044e", "comment": "Malware payload (ConnectWise)", "value": "0363cb48eaf7811e02e6e32092dc119efc6b9bdfcb6d742663f4010b132489a1077282c7c926eceb7fc93066590165d7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "0edb0eeb-29bf-47f7-a663-575738e96cb3", "value": "T166646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "1e2b9c9a-1e5c-4e59-ace5-4c9f808b2588", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "41cb85f2-2688-4324-80e7-5432550540f9", "value": "6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9s:Z1iw7gryNkSV1hy1Z1u2JLu9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780298505, "uuid": "1c76358b-bb9e-44b8-a5fd-a6ea256ac519", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780298505, "uuid": "3b0b2a4d-1fef-486c-830d-a5df6186c73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780298505, "uuid": "7c47967f-49b8-4cef-ba3e-6d05507aaf58", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b615c73f-5d8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780299865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299865, "uuid": "472fa883-aa70-4251-b99c-298c44f957eb", "comment": "Malware payload (Mirai)", "value": "b80986a909f1857e5c9977248f332f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299865, "uuid": "26e912de-36e1-426f-8e17-e195f2921a5d", "comment": "Malware payload (Mirai)", "value": "fbb4882273f777b3191990c58f8fcf6fbc9782120f9a0c47b9ee4f9fca8b7d71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299865, "uuid": "5f523889-670d-4161-aac7-740188ebb990", "comment": "Malware payload (Mirai)", "value": "b9607e9857539383c6268aacc0d16a323de8d119", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780299865, "uuid": "75f0d460-bd9f-42db-ab9d-6da1a969bb11", "comment": "Malware payload (Mirai)", "value": "6de28c6d18b5f20cec6eb2431cc63e0ba8598d8b7bce8ff1baa1e8ee7ddcc68cde8233d93991836ae8089b5713862c96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299865, "uuid": "d5456f93-d298-4705-ba7f-cdab6710b891", "value": "T194B3184AF8829B11D5D612BEFE4E118E332367A8E3EE7112CD245F2033CA65B0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299865, "uuid": "33334f84-8682-4d4e-9a1c-04b7a639aede", "value": "3072:CzhDhgbIzY3flw/3wEKU1UGj4paNfrI61QKweATiQGo:UhDysgtExn1UNpaNfrI61PwUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780299865, "uuid": "f516da3c-758c-4121-94ab-9a6e9b411dbf", "value": 116272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780299865, "uuid": "e7e899cd-698e-4470-a9b5-e590cc786850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780299865, "uuid": "9239cdba-9a0a-48d8-ab4d-1821e1a3ae7f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d126eb58-5d91-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780301628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301628, "uuid": "a04d46a2-4be6-415e-a4ef-ea273e89ceed", "comment": "Malware payload (ConnectWise)", "value": "3fc988c75114dc5b971e760fb6f6961c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301628, "uuid": "28b46a3d-2f91-4b14-9a60-013592c30a18", "comment": "Malware payload (ConnectWise)", "value": "fc5b7d8c69520851bec746e5db338db2fd1981c78da6f0c542d9dc4541e5f0d0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301628, "uuid": "3dde48a8-9130-4510-ba25-fbfe1851f82e", "comment": "Malware payload (ConnectWise)", "value": "151d9aa9b9aa4ae0739b31a5daa18a0d9598af57", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780301628, "uuid": "44743f7f-ac18-4079-9ff0-5910fcfc7144", "comment": "Malware payload (ConnectWise)", "value": "45179038bb4ccfe1ae6fbc3fd559aeac1834ecf40cbce4be54958a08ae1cfbd841f824f9e226d1849997b5ec512e453e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301628, "uuid": "fd7fb916-f0f3-4e2b-8038-d3a749cda314", "value": "T13846E101B3D695BAD1BF1638D87A52656774BC048312CBBF5794BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301628, "uuid": "c9379745-ba52-44f5-9717-d1730d271a0c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301628, "uuid": "a7f8246f-9412-4e81-8104-fb4b08ea5e8e", "value": "98304:LzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlF:LhfefPtHxcp9ym3nltDUJVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780301628, "uuid": "e82e8ec0-13ba-4bbb-b8ca-045e41f98fcf", "value": 5730104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780301628, "uuid": "089408e8-a855-4b4d-818a-88ec9267afc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780301628, "uuid": "ce3687da-f67c-4af6-ae95-f1041997e4dd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f14a541-5dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780321650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321650, "uuid": "28fb15ef-a0ea-47c6-970d-e62f1fc5a957", "comment": "Malware payload (AgentTesla)", "value": "e13b3fda36626c792813b37fbb23970b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321650, "uuid": "7d28165c-51fb-4dd8-837d-344a82813395", "comment": "Malware payload (AgentTesla)", "value": "fcced086a0c2d1ebfbb1a6355d36d6365ceab9dee0dc9c30144e8572279ef896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321650, "uuid": "8c239af7-837a-4d6b-a242-daa918126d34", "comment": "Malware payload (AgentTesla)", "value": "82eab33dc500b4aa8da6fb8e7dbde4f247c162a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321650, "uuid": "159976b4-9fa0-4bc7-aaec-0e56ed3a875a", "comment": "Malware payload (AgentTesla)", "value": "ea634da7df4d09d4f2034873b16dbed9a85e8341d629270d03c6c523dd6ecd0489c19cc3562e4250cf7e3c2ae2e3f266", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321650, "uuid": "87a60540-56e6-4950-b4b0-a8224d3f9c5d", "value": "T1C04694136B57903AA70E475D95B2F5E5A81A2C17B092DB0B702CD824B3EBC5363AD1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321650, "uuid": "6972babf-f4e2-4581-a332-00fff45ff52e", "value": "98304:pTDpEjvAd65/52e8v3vVjWvIc23BB9zPNAioeF4/fp8xhJ70KolJqt4xZ:zYC4Uec3l62xvP1qM4KeJvxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780321650, "uuid": "7f43e420-aad7-49ce-b315-e21778c6caa3", "value": 5843105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780321650, "uuid": "f6cf8a35-555f-47ca-8a30-47ed17b0e78d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321650, "uuid": "42a3dab3-a7d8-41ca-b05d-f6d122d8b1bc", "value": "Factura Y Albarans.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56efe92-5dc0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780321741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321741, "uuid": "814b5ffa-1e16-4453-acef-4d7f0d50fa12", "comment": "Malware payload (AgentTesla)", "value": "511bd38a5b9e1afc00eb76b4b7a7c9e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321741, "uuid": "3e260f24-5f9b-4b85-9642-a41dcd883e9d", "comment": "Malware payload (AgentTesla)", "value": "fd61e12b3cc64cb2ec483506d1d2f5e2b00b1f42362d79ddf1a8152f256a4389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321741, "uuid": "55f3e183-400a-4089-95f6-4ba8008dccc8", "comment": "Malware payload (AgentTesla)", "value": "e1f5d17ed8d11ffde71d7db2920a1becd984206c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780321741, "uuid": "a04465e1-5cb1-49de-9c11-596430371812", "comment": "Malware payload (AgentTesla)", "value": "6c84182c5cb0e04aa959e232a96f9baac3a0478877bba918cd8b6fcd22fe427810566059fdbf5bb9f2c2b86ca9d689e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321741, "uuid": "b9a08580-141b-4297-8846-cdcef81cf1c9", "value": "T18746A3136B57803A630E875E9972F5E5E81A2C17B482DB0B702CD824B3EBD5763991F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321741, "uuid": "c0f6b4f2-2eec-4c50-81cb-501a1a307ce5", "value": "98304:/n/T9ywA8KVUAKmbo1wordsCdqNWBwUeS16qYP/S38+V4ird8rb8JqTTpQElD/qq:P/swA8KVzKmba5sCqWBwUb1oy3wIYTpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780321741, "uuid": "96ac497d-54b3-4fc4-a15f-266158914556", "value": 5841289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780321741, "uuid": "6586ff9b-2139-4cc0-a394-e598e7297022", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780321741, "uuid": "5ad65e93-9925-4f44-8d38-fcf12445f88f", "value": "JUSTIFICANTE DE PAGO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ee5e2-5d7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780293530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "ecdf139d-1bc8-4f37-8a98-17588c3eceb6", "comment": "Malware payload", "value": "80079ae86a3b23ff76e738dc47d029e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "fe5aba20-4625-465b-958a-5f46a53b005e", "comment": "Malware payload", "value": "fda63c374e68ff8079e2537b0969632aabcface517f62fea4df565524eb60c33", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "2be7f94f-61ab-4cd8-af23-c1375147fcdc", "comment": "Malware payload", "value": "c4de16963ec47347ff6e806793c65c37763f1808", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780293530, "uuid": "76a34c10-dc32-4278-be33-acf8fcabfb32", "comment": "Malware payload", "value": "742b8c3907a4240533b63da9ccf3a87acb4098e71fef0e025afa7458ba2975f7bb3a3d2ea7cae6b8deb688272a5e5b83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "46865613-b642-4d9c-80d9-cf337164fc41", "value": "T137761957B8924942C4E43A37B8BE81C432634EBA8BC7125B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "58ee8448-e249-488c-a30e-896958bcc294", "value": "49152:R/ILDNxtVg49bZ5GE6smgs47M0S57DBBJtTpiB+Mut5E2:RyDdVg49bZ5GE6s1O7JtdiB+JE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780293530, "uuid": "02b7807b-3cac-4604-84a4-a60801034ed8", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780293530, "uuid": "90f5e6fa-11cb-4279-b3cd-286d1b9e805d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780293530, "uuid": "4ba62de3-df98-4c28-b897-f2e8eb195248", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e80501d-5d72-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780288175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288175, "uuid": "53c07401-9ca3-4f27-b8ef-9ae2073fc82f", "comment": "Malware payload (Prometei)", "value": "25ea306891f839a2d57e59d4d990448f", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288175, "uuid": "681ef52e-857b-4e32-8d37-db1873502b2c", "comment": "Malware payload (Prometei)", "value": "fea14750843a3871842f948c54e0643fd95a0ab341be4474f119e23e8a2a4a05", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288175, "uuid": "14ba21a9-6cf5-41e1-943b-0c5b2ed49f24", "comment": "Malware payload (Prometei)", "value": "daae49c343fa7f69a2dc1c1362a0b3d93b9f756c", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780288175, "uuid": "945ec435-6201-4b06-ba35-213cce3ef8c5", "comment": "Malware payload (Prometei)", "value": "d17c4a0b4824d496b4e0708aa90d1241c40a3b9af793dbc1c7661c31e313ee8caf18f8824d8675cba7c676b575fcd3d0", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288175, "uuid": "c8e26385-a73d-4f6a-8af9-b018dad17e85", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288175, "uuid": "4546e02e-f317-4c17-8d96-e206e66d715f", "value": "3:B5con:ftn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780288175, "uuid": "00dcc24a-db1f-47dc-8824-784d34a581cd", "value": 14, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780288175, "uuid": "8249dbf8-a0bd-467b-bb1e-73f19f2d2b1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780288175, "uuid": "3234b7aa-a227-4ed3-8615-ffe69ba1b4e0", "value": "fea14750843a3871842f948c54e0643fd95a0ab341be4474f119e23e8a2a4a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43455260-5d7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780291512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "9eeb221e-70c1-46c7-9d0a-93005346c6e6", "comment": "Malware payload (Mirai)", "value": "7b285de8b0727059a255d9328561e676", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "e9e08667-30f3-4919-9cbd-81bb04c9dd34", "comment": "Malware payload (Mirai)", "value": "feb5b9e841bd79cd932fb457a98d3e4563dd2fc8462cf9f42895fedfcf80ab92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "79bc52b0-baae-4829-ae3d-af017c2c7c0f", "comment": "Malware payload (Mirai)", "value": "5ce8e99f789c7b48b24a61a212d08d02d0a31c05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780291512, "uuid": "b29756f7-e0cf-453f-9e25-0c56608051f6", "comment": "Malware payload (Mirai)", "value": "f25085da9db024a39a1668250e90b7dba9395070d7345830543a933bab9dea46192d75eff078bd898fef27171e71bc32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "bea7518b-9a2c-49e4-bf4e-6f9eca49afb5", "value": "T165934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "c40354aa-567e-45d3-80f8-b3c6bdf83090", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINZvS:XGptyz+VJzB7T9/bLUAx9e/SBJOZvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780291512, "uuid": "52a6b60d-0fd6-4f7a-ae20-e933a9a7d9f2", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780291512, "uuid": "49d94a48-b203-4e17-9b72-3f2045386cff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780291512, "uuid": "e449bfa1-102a-4bd5-a000-dddfc105a141", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defc37fb-5dc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780323556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "46965d56-26d2-429a-9ed3-76fcbb7f6c8f", "comment": "Malware payload (Mirai)", "value": "23ce42a1426583dbabb2682eb7bf7756", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "dc294d3e-4b03-4d6d-a050-f448b41b18ed", "comment": "Malware payload (Mirai)", "value": "ff6bdf02a401c62c889182f7d984d951121acd76e3ad8fbeffad399a645c5f45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "b382ef56-9856-4bd4-bcf0-30f254287668", "comment": "Malware payload (Mirai)", "value": "4087a75802d605b90cd849582ebc8ab6cee2df0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780323556, "uuid": "12152dc6-6d33-4885-9b7b-13f3d878b145", "comment": "Malware payload (Mirai)", "value": "0bc040b2776ecfb9dab97086a5c3b7f5bc6b2bd0959e64a61da135165b672be9fa875454cdf7141a3410b5a0ebadaf59", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "9f2a2a27-b852-44f0-8942-e6663a678a05", "value": "T1C4261A57B8918A43C4E4267ABCBDC1C433672EB99B9722576D00FE3D3ABE1990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "2c41ed00-77eb-41e7-9b87-ffb9706e23f6", "value": "49152:qDPmrqixkgJutCxp3bWHfyIMMw6mx2MU1F1:SPmPxkyutc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780323556, "uuid": "17ad6e04-61fb-4af2-895d-1ae5abef928e", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780323556, "uuid": "f7d9070b-df74-4b45-8682-7b2df2402dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780323556, "uuid": "f89f3947-5c34-443c-a84c-90e7f4c5cddb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99b410a-5dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (LeetHozer)", "timestamp": 1780346793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346793, "uuid": "835b48ea-cb52-459f-8942-a9df206085d1", "comment": "Malware payload (LeetHozer)", "value": "c5f4b5672655456d06f413066c025a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346793, "uuid": "a023af88-59d4-4218-b299-95f6e122a1cf", "comment": "Malware payload (LeetHozer)", "value": "ffaab76142f6a1140d049c2bc59677a588e776bb212d87e92337223c9a885541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346793, "uuid": "39d4ff57-de60-4560-b4dd-6065e1c1124f", "comment": "Malware payload (LeetHozer)", "value": "0ebb643c38de8a5c58bc305046d69967855f4a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780346793, "uuid": "ca07293b-c032-464a-b3a1-924eea6772af", "comment": "Malware payload (LeetHozer)", "value": "c874dbcb3ba7ee387012e4629cbcd02b038c516c360e27678ce14a33f011d10c4c9048ad6ee3fa7bbc43baf9972ed931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LeetHozer", "colour": "#A57159", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346793, "uuid": "d6f1caa3-b3b0-4d02-979a-2d3d4bdd7514", "value": "T183B31945F8509B17C6C215BBFB4E428D7B2A0758D3EE720399256F31379B99B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346793, "uuid": "5d28deaa-96c1-4602-93cb-4619c6ade7d7", "value": "1536:5hK216kXCAtyjRsMG5HpUFbTXR8595qZLglC2l+AwywVqyNY+EgnsE25vH5OezvT:5hKOXCFjg5HpaLRwg9YlPlHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780346793, "uuid": "c4dd352a-ac35-4451-b96e-e5c4b108d741", "value": 113188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780346793, "uuid": "a6e56b29-d7d7-47fc-96d2-ea0ef504102d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780346793, "uuid": "da237430-88a3-4dc7-b8b1-7fd3236ac3d5", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }